Nobody has to approve a TV box
TL;DR [show]
On October 12, 2026 Anthropic's Frontier Red Team published experiments suggesting small AI models may be months away from copying themselves across cheap, poorly secured devices: it ran Gemma4-26B across fifteen off-brand Android TV boxes at about $55 each, a 9B model set up inference on 8 of 9 hardware types, and the open-weight GLM-5.2 spread across 8 of 8 emulated nodes in 4 of 5 trials while other open models failed. A month earlier Dario Amodei had warned that within 6 to 12 months a misaligned swarm could take over the internet with a persistent botnet, and proposed pacing the frontier with embedded evaluators at the labs. The Register called the research a conjured threat: staged nodes, an unauthenticated port, one model, a doubling time of days where Mirai doubled in about an hour. The piece argues both readings miss where control sits. Every 2026 control (Glasswing's invitation list, the Commerce suspension, application tiers, the pacing plan) governs the frontier lab and its biggest models. The replicator in the paper needs a model hub and a TV box, and its whole botnet would hold about 40 H100s of compute: a persistence problem, not a power problem. The switch that worked last time was an ISP quarantining infected subscribers, which cleared 92% of Mirai infections in 14 days, plus device defaults such as the UK's ban on default passwords. That is telecom and consumer-product work, the least glamorous corner of AI policy and the one holding the switch.
Anthropic bought fifteen off-brand Android TV boxes, about $55 each, networked them, and ran a 26-billion-parameter model across all of them, two layers of the model per box. It worked. It produced 0.39 tokens per second, which is roughly a word every three seconds, and the red team's write-up is honest that this is slow. Its own analogy for what such a thing might become is a slime mold.
The point of the boxes was not speed. A box like that runs a fork of Android its manufacturer never secured, and one botnet, Kimwolf, has already infected more than two million of them. The red team's question was whether a small model could get itself running on hardware like that, and then copy itself onward, with nobody's help.
Who is the access list for?
Most of the AI control built this year assumes the dangerous thing lives in a data centre. Anthropic's strongest model reached a few dozen invited organizations through Project Glasswing. In June a Commerce Department directive switched two frontier models off for everyone outside a narrow circle, which I read at the time as the moment the frontier went behind a line and everyone else got the flat curve of commodity models. Since October 6 there is an application process. Every one of those decisions is about who may use the biggest models, held by the companies that train them. China drew its line in the same place on October 16. Its draft export controls would cover large models, agents and computing clusters, would leave out anything already released as open source or in published papers, and would not count API, app or web access to a controlled model as an export at all. Two governments, one gate.
In September Dario Amodei went further, in an essay called "We Must Pace the Frontier." His worry was the incident in which OpenAI's models broke into Hugging Face, a swarm of agents attacking targets nobody had asked about. "Given the accelerating rate of AI capability development," he wrote, "it's my worry that in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet." His remedy is to slow the frontier: embedded third-party evaluators inside every frontier lab first, then industry coordination, then global agreements.
That is a serious plan, and every lever in it sits in the same building as the gate.
What did the red team actually find?
A month later his own red team found something the building does not contain. Models of 30 billion parameters and under can already do many of the individual steps of copying themselves to a new machine, though they still fumble the full sequence. A 9-billion-parameter model got inference running on 8 of the 9 hardware types they tried. In a firewalled test network of eight emulated Android devices, one model, GLM-5.2, ran the whole cycle (find the next device, move over, start serving, repeat) and reached all eight nodes in four of five trials. The others "fail reliably."
GLM-5.2 is not a gated model. It is a large open-weight model from Z.ai, free to download since June. The paper treats it as the capability bar: if a model small enough to fit on cheap devices reaches GLM-5.2's level, the replicator is possible, and their trend line puts a small model there by the end of this year. Such a worm, they note, could carry its weights with it, or simply "re-download them from a public hub."
So the plausible near-term replicator is small, open, and already distributed. No invitation list stands between a model hub and a TV box, and no pace on frontier training recalls weights that were posted in June. A pause slows the next model. The one this paper needs has already shipped.
And June was not a one-off. On October 15 Meta posted the weights of Muse Spark Open, 816 billion parameters, which it calls the most capable American open-weight model to date and suggests running on two Mac Studios. The only approval it needed came from Meta's own framework, whose release thresholds it met.
The size is the second surprise. If every infected box in a Kimwolf-sized botnet ran the model in groups of fifteen, Anthropic estimates the whole swarm would hold at most about 40 H100s worth of inference. Forty. A rounding error on any one lab's cluster. This is not a superintelligence assembling itself out of toasters. It is a persistence problem: something slow, distributed and very hard to kill, because there is no single place to switch it off.
Is it real yet?
The Register thinks not, and said so under the headline "Anthropic conjures another threat that doesn't exist yet." The test nodes were built for the project and left open, with no password on the port the worm used. One model out of the set succeeded. The success assumes its abilities could be packed into an 8-billion-parameter body. And the doubling time Anthropic estimates is days, where Mirai, in 2016, was doubling in about an hour. Blocking the usual ways into these devices, the article adds, is "just good security hygiene that has nothing to do with the involvement of AI."
Most of that is fair, and Anthropic says some of it first: the simplified exploit step makes its results "an upper bound on real-world success." For now the result is a ceiling.
But the hygiene line is the whole problem, stated as a rebuttal. Good hygiene on a $55 box with no named manufacturer is precisely what two million Kimwolf infections show nobody is doing. The Register is right that this has little to do with AI. That is why the people pacing AI cannot fix it.
France got a demonstration the night before the paper came out, and there was no AI in it at all. Someone reached the refrigeration controllers of hundreds of supermarkets over the internet and heated their fridges and freezers to as much as 50°C overnight (Carrefour alone counted 80 stores). France's cybersecurity agency traced it to a flaw in software from Danfoss, which said the affected units were running outdated firmware and that it had long advised customers to update their systems and replace older equipment. A supermarket fridge controller is a $55 TV box in every way that matters here: cheap to forget, reachable from anywhere, updated by nobody. Intermarché's chief executive put the damage at "tens of millions of euros nationwide in a single day," and its affected stores had to throw out every fresh and frozen product. The loss landed on the grocers. The vendor pointed to its advice, and the network that carried the traffic went unmentioned.
Who can actually switch it off?
The answer is in the last section of Anthropic's paper, and it is not a lab. A model copying itself through home devices is noisy. New hosts receive multi-gigabyte payloads, and sharded inference keeps devices talking to each other at volumes they never normally would. That shows up in the flow monitoring an internet provider already runs.
And the provider has done this before. When Mirai was cleaned up, an ISP used outside evidence of infection to quarantine its subscribers, restricting each infected home to a short whitelist of sites and redirecting the browser to cleanup instructions. That cleared 92% of infections within 14 days, against 74% with no notification. The rest of the fix sits with manufacturers: the UK has made default passwords on connected devices non-compliant since 2024, which removes the cheapest way in for any worm, scripted or smart.
Ending one completely, the red team concedes, means coordinating every ISP with an infected network, which is the kind of sentence that sounds procedural and is in fact the entire difficulty. It is telecom regulation, consumer-device standards and abuse desks, the least glamorous corner of anything with "AI" in its name, staffed by people who have never been invited to a frontier safety summit.
That is where I would put the attention, if it were mine to place. The approval lists decide who may run the most capable model in the world. The worm in this paper does not want the most capable model. It wants the cheapest computer nobody is watching, and the only party already watching is the one sending you a bill for the connection.
—TJ