Anthropic warns that small AI models could soon copy themselves across household devices, creating distributed networks that would be difficult to contain. Its researchers demonstrated that inexpensive Android TV boxes can collectively run a sizeable model, bringing the computing resources for a possible AI worm outside conventional data centers.
The shutdown warning is a forecast whose severity has not been established. The team describes a possible replicator as “challenging to shut down.” It does not report an uncontrollable AI spreading through homes, or establish that every smart television is vulnerable.
What the lab actually demonstrated
William Zhou and Daniel Freeman's October 12 research separates having enough computing power from having the capability to reproduce reliably. They ran Gemma4-26B-A4B across 15 off-brand Android TV boxes, costing about $55 each, at 0.39 tokens per second.
That demonstration split the model across networked machines. It was not one television independently running the entire system. A separate evaluation found a nine-billion-parameter agent could establish inference on eight of nine hardware types, but completing individual steps did not establish a functioning autonomous worm.
The authors make that limit explicit:
We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).
In a controlled replication test, GLM-5.2 established Llama3.1-8B inference on all eight cloud-hosted Android emulators in four of five trials, reaching seven in the other. Smaller tested models failed to complete the full sequence.
Crucially, the controller model ran on a separate server, and access to the targets was deliberately simplified. The experiment measured orchestration and inference setup under favorable conditions, not reliable attacks on protected consumer devices.
The timing remains conditional
Weight-based replication would carry model weights, or download them, then run inference on compromised hardware. API-based replication would instead depend on a provider continuing to serve requests. The researchers examine both routes but concentrate on the former, which moves the computing requirement into the devices themselves and changes where defenders would need to intervene in practice.
The end-of-2026 projection assumes small models keep improving at their historical pace. It uses the Epoch Capabilities Index as a proxy for replication ability, which the authors describe as a rough estimate. Neither the date nor an autonomous escape is established as inevitable.
Their broader warning is also explicitly predictive:
As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control.
A distributed model could keep operating without a single central host, complicating containment. The researchers nevertheless anticipate slow replication, potentially over days, and describe network traffic that defenders could detect. They did not test an AI botnet intelligently countering defenders.
Difficult does not mean undefendable
The paper recommends network monitoring, isolation of infected customers and stronger device security. A historical study of Mirai cleanup found that quarantine and notification removed 92% of infections within 14 days. That concerned conventional malware, not an AI worm, so effectiveness against this proposed threat remains untested.
In a separate October 12 announcement, the company said early evidence indicated its defenses reduced data harvested through illicit distillation by roughly 90% to 99%. That addresses copying capabilities between models through abusive service access, rather than autonomous replication onto household hardware.
As previously reported by Apex, Bill Gates has called for stronger public safeguards against AI misuse. This new research identifies a potential containment problem, while preserving an important distinction: the team has demonstrated several prerequisites, not a rogue system that cannot be stopped.