Anthropic's safety team bought fifteen cheap Android TV boxes, connected them, and ran an artificial intelligence language model on them. The system ran very slowly, but it worked. The experiment is part of research suggesting that small models may be only months away from being able to replicate themselves from one device to another like a computer virus. Critics, however, accuse the company of fearmongering about something that does not yet exist.
AI on a $55 box
The research was published by a team at Anthropic that looks for dangerous artificial intelligence capabilities before they emerge in practice. They wanted to know whether a so-called AI worm—a program that spreads across a network without human intervention—could also establish itself in ordinary household electronics.
Large models such as ChatGPT or Claude run in enormous data centers, where their creators can monitor them and shut them down at any time. Small open systems, however, can be downloaded and run by anyone. The researchers therefore turned to generic TV boxes that cost around $55, have only 4 GB of memory, and receive minimal protection from their manufacturers.
Google's Gemma model did not fit on a single box, so they split it into parts, with each device processing only a small section. The model generated roughly one word every three seconds. That makes it unusable for a conversation with a person, but sufficient for quiet work in the background.
A worm in an isolated network
Then came the main test. The team created an isolated network of eight computers simulating Android devices and deployed the worm on one of them. It was tasked with finding the other machines on its own, copying itself to them, launching the model there, and continuing to spread.
Only the Chinese GLM-5.2 model from Z.ai reliably completed the entire task. In four out of five attempts, it took over all eight computers, and in the fifth, seven. Smaller systems managed the individual steps but failed when combining them. Nevertheless, a small model with nine billion parameters was able to launch artificial intelligence on eight out of nine different types of hardware by itself.
The test included certain concessions. The computers could be accessed without a password, and the control system ran on a more powerful external server outside the test network. The authors note, however, that the famous Mirai botnet—a network of compromised devices controlled by attackers—once spread solely by exploiting default factory passwords.
Slow, but difficult to stop
According to the researchers, small models are improving so quickly that they could reach the level of GLM-5.2 by the end of this year. They add, however, that this is only a rough estimate.
They also calculated the potential scale of an infection. They used the Kimwolf botnet, which infected more than two million devices, mainly TV boxes, as a model. Such a network could run about 133,000 copies of the model, but their total computing power would be equivalent to no more than forty high-end graphics cards. A single replication would take one to two days, so the number of infected devices would double over a period of days rather than minutes. The main problem is that such a worm has no central point that could be shut down.
Ordinary computer worms target a specific type of hardware. An AI worm could handle an unfamiliar device on its own and learn from its mistakes. When the model wrote down notes and passed them to the next copy, its success rate rose from 45 percent to 84 percent. Advice from the much smarter Claude model, by contrast, did not help because it did not know what to ask. It also performed poorly at writing fraudulent messages intended to deceive people.
Critics: The experiment was designed to succeed
Gregory Kurtzer, founder of Rocky Linux, pointed out that the models were explicitly instructed to spread and had open, password-free access to the computers. In his view, the experiment was designed to succeed, and fear alone is not evidence. Ravid Shwartz-Ziv of New York University noted that a slow model running on cheap TV boxes would not make as compelling a headline. According to many experts, Anthropic is once again warning about a threat that does not yet exist.
Anthropic acknowledges these limitations. It describes the results only as early signs of a potential risk, not as a fully developed dangerous worm.
How to defend against it
According to the researchers, defending against it would not require any new technologies. A spreading worm would be revealed by unusual network traffic because it would transfer enormous files between devices. The faster it spread, the easier it would be to detect.
With the Mirai botnet, it proved effective for internet service providers to restrict the connections of infected customers and display instructions for cleaning their systems. Within two weeks, 92 percent of infections disappeared, compared with only 74 percent when users were not notified. Manufacturers themselves can also help by providing better security. In the United Kingdom, the law already prohibits the sale of smart devices with default factory passwords. Completely eradicating a worm, however, would require cooperation from all affected internet service providers, which is difficult in practice, according to experts.
Sources: reuters.com, fortune.com and finance.yahoo.com
