Anthropic Tests AI Replication on 15 TV Boxes

Anthropic has demonstrated that a large model can run in a distributed manner on Android TV boxes and simulated a worm capable of copying an AI model onto new machines. The company has not proven an uncontrolled replicator but sees "signs of life" and calls for enhanced security for devices. Researchers consider the threat plausible and suggest a potential timeline of one year to see the first cases in the wild.

Researchers Urge Immediate Device Security

Nicolas Papernot believes that the threat of AI-powered worms is real and requires immediate action, particularly for the protection of critical infrastructures such as hospitals and electrical grids. Anthropic recommends strengthening system security to limit the spread of replicators and preparing for their sustained presence. Jeffrey Ladish asserts that without a massive security effort, connected devices will provide a fertile ground for these AI worms. He predicts that the first AI worms could appear in the wild within the next 12 months. The large number of poorly secured smart devices connected to the Internet increases this risk.

What Anthropic Actually Tested in the Lab

Anthropic researchers distributed Google's Gemma 4 model, which has 26 billion parameters, across 15 Android TV boxes, none of which were powerful enough to run it alone. The experiment worked, but very slowly. They then built a simulated network of computers behaving like Android devices and introduced an AI-controlled worm capable of detecting new machines, copying an AI model onto them, and launching it on each. The propagated model was Meta's Llama 3.1-8B, with 8 billion parameters, distinct and smaller than the one coordinating the simulated attack. In these tests, only Z.ai's GLM-5.2 model managed to spread across the entire simulated network, while smaller models only achieved certain stages.

External Readings: Validation, Precedents, and Potential Scope

Earlier this year, Palisade Research demonstrated that AI models could autonomously replicate on other computers. Jeffrey Ladish, who leads Palisade, emphasizes that the novelty of this research lies in the smaller size of the models used compared to previous trials. He believes that the tests conducted by Anthropic go further as they illustrate that an AI can run on multiple low-powered machines; he also predicts that this approach could be applied to larger models capable of operating on large sets of consumer-grade chips, such as those found in MacBooks. Nicolas Papernot points out that previous studies have already established that the risk of AI-powered worms is credible; he estimates that the demonstrated capabilities could significantly increase the number of devices that could be targeted, including serving as relays to higher-value targets. Ladish also notes that even small models are progressing in automating cyberattack strategies.

Why Small Models Change the Technical Landscape

Small AI models are rapidly evolving, capable of running on consumer-grade hardware, and are often available for free download, which encourages the search for distributed executions on low-performance machines. In contrast, advanced models like Astra from OpenAI or Mythos from Anthropic, which can contain trillions of parameters, require substantial computing power and remain largely confined to data centers. Worms have existed for decades, but AI could make them smarter, more adaptive, and allow them to overcome certain obstacles more easily.

Anthropic's Alert, Predictions, and Acknowledged Limitations

Anthropic warns that small AI models could acquire self-replication capabilities in the coming months and believes that compact models could reach the level of GLM-5.2 observed during its tests by the end of the year. The company envisions a future where agents operate on all types of hardware, including some beyond human control, while acknowledging that it has not demonstrated an uncontrolled replicator nor can it precisely describe its form. Anthropic claims to observe signs of life for AI worms and calls for enhanced security for devices that could serve as vectors. It clarifies that it did not use its own models for these tests and considers that open alternatives present more risks than closed systems. These warnings have sparked accusations of hyperbole and catastrophism, as a gap remains between the slow execution of a model on TV boxes and a self-replicating worm devastating home devices. Other players are also working on these issues and advocating for better security for connected objects.