Skip to content
NewsResearch

Anthropic shows a 9B model setting up inference on 8 of 9 IoT device types

· by Pondero Newsdesk

The short version

Anthropic's Frontier Red Team ran distributed inference across 15 cheap Android TV boxes and warned small open-weight models could match the capability needed to self-replicate on IoT hardware by the end of 2026.

Anthropic shows a 9B model setting up inference on 8 of 9 IoT device types

Anthropic's Frontier Red Team wired 15 off-brand Android TV boxes together, ran a 26-billion-parameter model across them, and used the setup to argue that a self-replicating AI worm on consumer smart devices is closer than most defenders assume, per Anthropic's research post published October 12, 2026.

What

Researchers William Zhou and Daniel Freeman ran Gemma4-26B-A4B distributed across 15 Android TV boxes costing about $55 each, splitting the model's layers across the fleet and serving it at roughly 0.39 tokens per second, per Anthropic. In a separate test measuring whether smaller models could set up inference on unfamiliar hardware, a 9B model got inference running on 8 of 9 hardware types tested. When the team tasked open-weight models with scanning a network, breaking into a new device over an unauthenticated port, and standing up inference there, only GLM-5.2 completed the full chain reliably, reaching 8 of 8 nodes in 4 of 5 trials. Plotted against a model-size trend line, that capability level suggests models of 30 billion parameters or fewer could match it by the end of 2026, per the same post. The researchers were explicit that they did not demonstrate a fully autonomous worm running on real-world IoT hardware, only the individual stages that such a worm would need to chain together.

Botnets without a kill switch become a patching problem, not a takedown

A weight-based replicator that lives entirely on compromised IoT devices has no central server to seize or subpoena, which is the property that makes it different from the API-credential-theft or datacenter-breach threat models Anthropic also sketched out. Speed estimates in the paper temper the urgency some: a full inference-setup cycle for Gemma4-26B-A4B took 71 to 150 hours in testing, and the researchers compared the likely spread to "a slime mold or a swarm of fruit flies" rather than a fast-moving exploit. That slowness is the defenders' main advantage, since sustained device-to-device traffic between machines that normally never talk to each other would show up as an anomaly to an ISP watching flow-based traffic, well before a botnet reached meaningful scale.

Context and reactions

The scenario is grounded in the real-world Kimwolf botnet, which Synthient reported had infected over 2 million devices, mostly off-brand Android TV boxes, using nothing more sophisticated than default manufacturer passwords. A precedent for cleanup also exists: ISPs that quarantined and notified customers during the Mirai botnet response cleared 92% of infections within 14 days, against 74% when they quarantined without notifying anyone. BleepingComputer's coverage of the research kept the same caveat Anthropic led with: no fully autonomous worm has actually run on live IoT hardware yet, per BleepingComputer's report. Recommended defenses center on exactly the signal the traffic-pattern argument implies: detecting unusual device-to-device transfers, deploying honeypots to capture a replicator's payload once one is found, and quarantining infected devices at the ISP level.

What to watch next

That trend line puts a capable small-model replicator within reach before the end of 2026, so the open question is whether IoT vendors move on hardening defaults, such as the UK's new rule against shipping default passwords, before that window closes. Other labs may publish comparable red-team results on distributed inference and autonomous replication, and ISPs could start testing flow-based anomaly detection against this specific traffic signature.

Sources