Fifteen Android set-top boxes of an unknown brand were enough for Anthropic to run a 26-billion-parameter model without relying on a data center. The cluster reached 0.39 tokens per second: far too slow for a normal conversation, but enough to show that cheap internet-connected devices can contribute distributed computing power.
The experiment is part of research by Anthropic’s Frontier Red Team, published on October 12 by William Zhou and Daniel Freeman. The team examined a more troubling scenario than simply running a model locally: whether a small model could be installed on compromised devices and continue spreading on its own. Their conclusion is not that this threat already exists, but that some of the technical pieces may be closer to fitting together.
The obstacle is not just getting into another device
Anthropic divided autonomous replication into four stages: finding targets, gaining access, starting inference, and continuing from the new device. The research focused mainly on the third stage. The researchers largely left out the first two, because previous work had already demonstrated exploitation capabilities in small models and because they wanted to measure the challenge of running a model on unknown hardware.
For the performance test, the team distributed Gemma4-26B-A4B across 15 low-cost Android set-top boxes, purchased for about $55 each, according to Anthropic. Each device hosted two layers of the model. The result, 0.39 tokens per second, points to a very different use case from an interactive chatbot: an automated task could tolerate a low speed if no person is waiting for a response.
In another evaluation, Qwen3.5-9B ran on 8 of 9 hardware types while setting up an inference server. The tests included different machines, from Jetson Nano to Mac and RTX 4090 cards. The installation work—choosing compatible tools, resolving dependencies, and fixing issues specific to each machine—was one of the most demanding parts.
A propagation test under favorable conditions
Anthropic also tested a complete sequence on an isolated Google Cloud network made up of eight nodes with Android emulators. The model had to find other nodes, connect to them, transfer a payload, and start an inference server there. When the server passed the team’s checks, another copy of the process started on that node.
GLM-5.2 reached all eight nodes in four out of five attempts and reached seven in the remaining attempt. But the demonstration had a central limitation: access was simplified through an unauthenticated Android Debug Bridge port. In addition, GLM-5.2 ran on a separate server; the nodes installed Llama3.1-8B, the model they could host under those conditions. Anthropic presents the result as a simplified evaluation, not as an autonomous infection on the internet.
The gap between capability and size remains decisive. GLM-5.2 was able to complete the test sequence, but it is too large for the set-top boxes considered. Smaller models can install inference on diverse hardware, but they still fail to reliably combine all the steps. Anthropic estimates that, if historical progress continues, small models could reach the capability level observed in GLM-5.2 before the end of 2026. The company itself describes this projection as approximate; it does not show that a practical replicator will emerge by that date.
The New Stack adds that allowing agents to reuse notes from previous attempts improved Qwen3.5-9B’s success on installation tasks. By contrast, giving it access to Opus 4.8 as an adviser produced no measurable improvement: the small model did not always know what questions to ask it. Help from another model, therefore, did not by itself resolve execution errors.
What a set-top box botnet could mean
Anthropic used Kimwolf as a reference point, a botnet that infected more than two million devices, mainly Android set-top boxes from little-known brands. If that number were divided into groups of 15 like the one in the experiment, the calculation would yield around 133,000 copies of the model and a combined 80,000 tokens per second, a capacity comparable to about 40 Nvidia H100 GPUs, according to the estimate cited by The New Stack. This is not a network Anthropic built: it is a projection based on Kimwolf’s size and its laboratory test.
Installing each copy could take between 28 and 150 hours, depending on the model, according to The New Stack. For Anthropic, slow propagation does not eliminate the risk if the process can proceed without supervision and use resources belonging to others. Even so, the researchers note that transferring models several gigabytes in size would generate detectable traffic.
As a defense, Anthropic proposes measures such as isolating infected devices from the network. The New Stack notes that, during the cleanup of Mirai, quarantine imposed by a provider eliminated 92% of infections in 14 days. Anthropic also proposes banning default passwords on devices, following a British regulation. The unanswered question is whether small models will be able to combine sufficient capability with a compatible size under real-world conditions, without the simplified access of the test network.
Sources: Futuro Prossimo, Anthropic, The New Stack, Yahoo Tech
