The report
Anthropic published tests of model inference on inexpensive Android hardware and a separate, controlled exercise in setting up agent replicas on October 12. Together they illustrate the prerequisites for autonomous edge propagation, but they do not document an uncontrolled AI worm or devices compromised outside the experiment.
The hardware result is concrete: 15 inexpensive Android TV boxes jointly served Gemma4-26B-A4B at about 0.39 output tokens per second. This is very slow distributed inference, not 15 independent high-speed agents. In a distinct setup task, Qwen3.5-9B configured inference on eight of nine tested hardware types. These are measures of model serving and installation competence, not observed propagation across a real botnet.
Anthropic then used a contained 17-node redroid fleet in a firewalled GCP VPC. Its larger acting model, GLM-5.2, reached eight of eight target nodes in four of five trials and seven of eight in the fifth, under simplified conditions. Those results are significant within the benchmark, but the setup deliberately removed authentication from the Android Debug Bridge access path. More importantly, the evaluator ran the controlling model elsewhere and spawned the next acting agent through a harness after an installation check. The nodes did not independently host and launch GLM-5.2 as a fully self-contained replicator.
Why the two results do not yet combine into a worm
| Observed component | What Anthropic demonstrated | What remains unproven |
|---|---|---|
| Local model compute | A large model could serve slowly across 15 low-cost TV boxes | Useful sustained autonomy on a single small host |
| Cross-hardware setup | A 9B model installed inference on eight of nine tested platform types | Exploit-driven initial access and reliable persistence |
| Emulator propagation task | A stronger, externally served model configured target nodes in simplified trials | An entirely local model that discovers, accesses, installs and independently spawns its successor in the wild |
The publication estimates when smaller models could combine the requisite capability with affordable device memory, extrapolating from model trends and a historical botnet. That forecast is conditional, not an observed deployment date. Its throughput arithmetic depends on hardware mix, access and continuous availability. The original research describes those assumptions, while the evidence dossier tracks the measured results and remaining gaps.
A relevant defensive question is not whether a TV can run an open-weight model at any speed. It is whether an adversary can acquire device control, deploy executable runtimes and weights, coordinate peers, and retain control without the evaluation's external harness. This study strengthens the case for monitoring those access and execution transitions; it does not establish a live wave of AI-propagated IoT compromise.