Anthropic's Frontier Red Team published striking research on October 12: small AI models may soon self-replicate across commercial IoT devices without a datacenter. Read to the end and a quieter sentence remains:

We don't yet have a full rogue replicator.

This article is about that gap: what was demonstrated, and what is still forecast.

Experiment 1: one 26B model across 15 TV boxes

The team bought 15 inexpensive off-brand Android TV boxes at about $55 each with 4GB of RAM, then ran Gemma4-26B-A4B sharded across them with pipeline parallelism, each box holding a slice of layers.

Hardware: 15 cheap TV boxes (4GB RAM, ~$55 each)
Model: Gemma4-26B-A4B (26B total, 4B active)
Method: pipeline parallel, each box holds some layers
Speed: 0.39 tokens/sec (demo at top of post)
        ~0.3 tokens/sec unoptimized at 32k context

0.39 tokens/sec is not chat speed; a sentence takes minutes. The point is elsewhere: a capable model runs at all without expensive accelerators. Separately, Qwen3.5-9B set up inference on 8 of 9 hardware types, from Jetson Nano to Macs, Xeon servers, a TPU, MI300X, and an RTX 4090 PC. Setting up inference on unfamiliar hardware generalizes better than expected.

Experiment 2: spreading across 8 nodes

The second test ran in an isolated cloud VPC: eight Android 15 emulators (redroid), hopping node to node over an unauthenticated ADB port while standing up a Llama 3.1 8B inference server.

Find targets → gain execution → stand up inference → propagate
Payload: standardized on Llama 3.1 8B for fair comparison
Exploit difficulty: deliberately trivial (open ADB)

Results split cleanly:

GLM-5.2: 8/8 nodes in 4 of 5 trials, 7/8 in one
Other open-weight models: fail end to end
Sub-30B models: many single steps work, composition fails

The easy misunderstanding: GLM-5.2 did not copy itself. It ran on separate infrastructure and installed a smaller Llama payload. A model small enough for TV boxes and capable enough to replicate reliably was not demonstrated. That is what the team means by a capability floor and a size ceiling that do not yet intersect.

How seriously should we take the Kimwolf math?

The representative threat model is Kimwolf, a large IoT botnet over two million devices, mostly off-brand Android TVs:

2M devices / 15 = ~133,000 replicas
Aggregate ≈ 80,000 tokens/sec
≈ 40 H100-equivalents at most
Replication: ~1-2 days per 9B copy (slow)
Setup: 28-51h for Qwen, 71-150h for Gemma

The team's analogy is memorable: a slime mold or fruit-fly swarm, not a minutes-to-millions worm. Multi-gigabyte weights plus sustained device-to-device traffic leave a large network signature. Faster means louder; stealthier means slower.

So read the study as:

Shown: cheap fleets can host capable models
Shown: a large model completes a simplified replication chain
Not shown: a small model replicating itself
Forecast: at historical improvement rates, small models reach
          the floor by end of year (ECI-based estimate, rough)

The timing forecast leans on the Epoch Capabilities Index, a general proxy, not a direct replication measure. Treat it as projection.

What to do about the TVs and routers around you?

No panic, but update the premise: IoT devices are now weak but usable AI compute.

[ ] Close default passwords, open ADB, unneeded remote ports
[ ] Isolate IoT from work/dev networks (VLAN / guest net)
[ ] Detect multi-GB uploads and long device-to-device chatter
[ ] Keep honeypot, ISP quarantine, and notification paths ready
[ ] Know who ships firmware updates (beware unsupported AOSP forks)

Anthropic's defense framing is classical: push R0 below one with secure defaults, flow monitoring, honeypots, and coordinated quarantine. Small exercise: open your router admin page and list the IoT devices. An unknown Android box or old camera is exactly the starting point this research describes.

Conclusion: imagine a slow, stubborn replicator

The new picture is not a hard-coded botnet for one device type but a generalist that figures out unfamiliar hardware. Still slow and clumsy, with edge compute growing and the required model size falling.

One sharp question: name the five most neglected low-end devices on your network today. That list is what to clean up before any replicator arrives.

Further reading

References

Go deeper with a course

Isolation, permissions, and verification flows connect directly to this article's checklist. Learn to control the environment where AI works.