Anthropic Red Team Says Small Models Are Months From Copying Themselves Onto Smart TV Boxes

Anthropic's Frontier Red Team published research on Oct. 12 arguing that small open-weight models may be months from copying themselves onto cheap internet-connected devices such as Android TV boxes, with no datacenter GPU involved. The post is signed by William Zhou and Daniel Freeman, and the page gives no job titles for either.

The authors said such a replicator would be hard to shut down because it has no central point to switch off. They also said it would spread slowly, with a doubling time of days.

What the team ran

A 9B model, Qwen3.5-9B, got inference running on 8 of the 9 hardware types tested, from Jetson Nanos to Mac PCs and RTX 4090s. Gemma4-26B-A4B ran across 15 off-brand Android TV boxes, each about $55 with 4GB of RAM and holding two model layers. Throughput was 0.39 tokens a second in the introduction and about 0.3 in later sections of the same post.

The end-to-end test was narrower. In a simplified Google Cloud setup with 8 redroid nodes running Android 15, GLM-5.2 was the only open-weight model to replicate reliably. It reached 8 of 8 nodes in 4 of 5 trials and 7 of 8 in the fifth, with Llama3.1-8B as the payload it served.

Models of 30B parameters or fewer could finish many single replication steps, the authors said, but made mistakes when chaining them.

The speed estimates

Anthropic gave unoptimized timings for the two models it ran on the TV-box cluster.

Model	Hours per 32k context window	Hours for full inference setup
Qwen3.5-9B	10.9	28 to 51
Gemma4-26B-A4B	27.3 to 31.8	71 to 150

The authors assumed 32k tokens of context because models performed poorly below that. For scale, they took the Kimwolf botnet, which Anthropic says holds more than 2 million devices, mostly Android TVs, and estimated about 133,000 model replicas producing about 80,000 tokens a second. That equals roughly 40 H100 GPUs at high concurrency, by Anthropic's arithmetic.

The Hacker News reported on May 22 that the U.S. Department of Justice had arrested Jacob Butler, 23, of Ottawa, on one count of aiding and abetting computer intrusion over Kimwolf. The Hacker News described Kimwolf as an AISURU variant that infected Android devices with an exposed Android Debug Bridge service. Its article gives no device total, so the 2 million figure rests on Anthropic.

Four limits the authors listed

The exploit in the GCP test was trivial, an unauthenticated ADB connection, so the authors called those results an upper bound on real-world success. The Epoch Capabilities Index, which they used to project progress, is a general capability proxy and not a measure of replication.

The botnet estimate is anchored to one device class and one past botnet. The Gemma throughput figures are unoptimized.

On timing, the post cites a trend of 13.7 index points a year with an R² of 0.95 and projects small models reaching GLM-5.2's level by the end of 2026.

Reaction on Hacker News

The thread drew pointed doubt. A commenter named hypfer wrote "That's not science. That's science fiction," objecting that a roughly 744B-parameter model's capabilities could not fit in 8B parameters. Another, verdverm, asked which IoT devices have 20GB of storage for a 9B model plus enough memory to run it. Others, such as pythonaut_16, called the post fearmarketing.

A commenter named aaroninsf argued the opposite, that the risks of open access to highly capable models are unprecedented.

Anthropic's own tests were modest on one point. Giving Qwen3.5-9B access to Opus 4.8 as an advisor did not improve its results. A harness that passed notes between generations lifted Qwen3.5-9B's inference-setup success from 45% to between 61% and 84%.

For defence, the authors pointed to network flow monitoring for multi-gigabyte payload transfers. They cited Mirai, where ISP quarantine cleared 92% of infections within 14 days, against 74% without notification. The payloads in the tests are open-weight models, whose licence terms the site has covered. Separately, AI agents rebuilt a shooter's source from a binary in a separate case the site has reported.

The appendix estimates 9.5 million NVIDIA edge units in the field, worth 9,000 to 35,000 H100-equivalents, with a Jetson AGX Orin 64GB running Qwen3-30B-A3B at 76.7 tokens a second. The authors said the reachable and vulnerable share is likely much smaller.