The Worm That Leaves Notes
For about $825, Anthropic’s Frontier Red Team wired together 15 off-brand Android TV boxes, about $55 apiece, and got an AI model running across them. It produced 0.39 tokens a second. No one would chat with it at that speed, but a program with no one waiting on it doesn’t need to be fast.
The boxes were a proof point in a report Anthropic researchers William Zhou and Daniel Freeman published Monday, and which The New Stack reported Tuesday. Their conclusion: small, freely downloadable AI models may be months away from copying themselves across cheap internet-connected hardware, with no data center required.
In a sealed test, a large open-weight model, GLM-5.2, spread across eight emulated Android machines, getting a small AI model running on each one. It reached all eight in four of five trials, through a door the researchers left open on purpose. A smaller model showed something stranger. Each attempt left notes for the next. Over six generations, its success at getting itself running climbed from 45% to as high as 84%, with no retraining. The researchers call it Lamarckian evolution. A worm could learn as it spreads.
The targets are already out there. In June 2025 the FBI warned that millions of cheap, mostly no-name devices, many of them TV streaming boxes, had been pulled into a botnet called BadBox 2.0. Early this year a botnet called Kimwolf was found to have hijacked more than 2 million Android devices, most of them off-brand TV boxes. Nobody publishes a count of no-name boxes in American homes. North America was forecast to take in about 50 million new TVs last year, and the cheap boxes are bought to sit beside them.
The paper’s rough estimate is that small models will be capable enough by the end of 2026, with self-replicating ones possible soon after.
There is a defense. Moving multi-gigabyte models makes noise that internet providers can see, and in the Mirai botnet cleanup, one provider’s quarantine cleared 92% of infections within 14 days.
For readers: keep your devices updated, skip the no-name box, and change the default passwords.
