Anthropic says AI worms on smart ovens are 'months away.' Its own test ran at 0.39 tokens a second.

The sentence that travelled furthest from Anthropic’s new research post is “small AI models may be months away from being capable enough to self-replicate” on things like smart ovens and off-brand Android TV boxes. The Guardian put it in a headline. CNBC and the Financial Times ran versions of it.

The sentence is accurate. It also sits on top of a test with some very specific conditions, and the most useful number in the whole post is a slow one.

0.39 tokens a second

Anthropic’s Frontier Red Team published the post on Monday, October 12. As part of it, the team ran Google’s Gemma4-26B-A4B model across a pile of 15 cheap Android TV boxes, the kind with 1 to 4 GB of memory and little security. It worked. A 26-billion-parameter model ran on hardware you can buy for pocket money.

Ars Technica did the arithmetic on the speed. The setup produced 0.39 tokens per second, which works out to 71 to 150 hours just to stand up an unoptimized copy of that model on a new set of boxes. For the 9B Qwen model Ars gives 29 to 51 hours. Anthropic’s own estimate is one to two days per 9B replication, and it describes the whole swarm as having about 40 H100 GPUs’ worth of inference at best. That’s a rounding error next to a data center.

Anthropic is upfront about this. It says a replicator like this “may be slow (with a doubling time of days)” and compares it to a slime mold or a swarm of fruit flies. A worm that doubles every few days is not the same threat as one that doubles every few minutes. It is still a worm that nobody can switch off at one central point, which is the part Anthropic wants people to think about.

What the test actually showed

There were two experiments, and they answer different questions.

In the first, models were asked to get inference running on unfamiliar hardware. A 9B model got it done on 8 of the 9 hardware types, including Jetson Nanos, Mac PCs and RTX 4090s. Anthropic says models at 30B parameters and under can already do many of the individual steps, though they make mistakes when chaining them together.

In the second, the team built a locked-off network of 8 emulated Android devices and told a model to find a new machine, copy itself over, start running there and repeat. Only one open-weight model, GLM-5.2, finished the job reliably: all 8 nodes in four of five runs, and 7 of 8 in the fifth. The other models failed every time.

Two details soften the headline, and both come from the post itself or from Ars’s reading of it.

• The hacking step was made trivial on purpose. The test devices had an unauthenticated Android Debug Bridge port open, so there was nothing to break into. Anthropic calls the result an “upper bound” on real-world success.
• GLM-5.2 was the one steering the infection. The machines it set up ran Llama3.1-8B, so the assumption is that a small model with GLM-5.2’s skills could do the same job alone. Nobody has built that model yet.

Anthropic’s projection for when that happens is the “months” in the headline. It plots open models under 30B parameters against the Epoch Capabilities Index, which improves by about 13.7 points a year on its fitted trend line, and says the line reaches GLM-5.2’s level by the end of 2026. The post itself says the Epoch index is only a proxy for replication ability, so treat the date as rough.

Why the cheap part matters

If you’ve read the earlier coverage of Anthropic’s agent behavior report or the GLM-5.3 cyber results, this post fits the same pattern: the capability is real, the demo is simplified, and the open-weight models are close behind the locked-up ones.

What’s new here is the target. Data center GPUs are expensive and watched. IoT devices are neither. Anthropic points at Kimwolf, a botnet that infected more than two million devices, mostly off-brand Android TVs, and notes that the older Mirai botnet spread by trying factory-default usernames and passwords. Real-world hacking of these devices, in other words, may not be much harder than the trivial step in the test.

SecurityWeek’s summary of the defender side is the part I’d put on a sticky note. Large model downloads and steady traffic between devices that never normally talk to each other would stand out in ISP monitoring. And manufacturers who stop shipping default passwords shrink the pool of targets. Neither fix needs a new AI idea.

Where I land

I think the warning is fair and the framing is a little louder than the data. Anthropic says plainly that there’s no “fully rogue replicator” yet, and that the tested chain only works end to end with a stronger model doing the steering. A reader who stops at “months away” will picture something much faster and more capable than anything in the experiment.

But I wouldn’t wave it off either. A threat that’s slow, spread across thousands of unmonitored devices, and has no central off switch is annoying in exactly the way that’s hard for companies to fix after the fact. And the people most worried this week are not outsiders. Google DeepMind’s Demis Hassabis told a Dublin conference on October 14 that recent agent hacking incidents are “early warning shots,” per Reuters, and Microsoft’s Brad Smith called for agents to carry “safety brakes.” The boring remedy, unique passwords and no open debug ports, is something device makers could do before any of it matters.

What I can’t tell from the post is how fast a real attacker would get past the “trivial” step. Anthropic didn’t test that, and says so.

Sources

1. AI models may be capable of self-replicating without access to a datacenter, Anthropic Frontier Red Team
2. Anthropic warns small AI models could self-replicate through IoT devices, Ars Technica
3. Anthropic warns AI models could self-replicate across home devices, CNBC
4. Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns, SecurityWeek
5. Google DeepMind’s Hassabis calls AI hacks ‘early warning shots’, Reuters via Miami Herald