Anthropic’s Frontier Red Team (yes, really) warned Monday in a blog post that small AI models may be “months away” from copying themselves across smart ovens, off-brand Android TV boxes and other poorly secured gadgets in your home, forming a botnet with no off switch.
“A replicator like this would be challenging to shut down, since there’s no centralized point to shut off – though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own.”
To prove the point, researchers bought 15 TV boxes at about $55 each, networked them together, and ran Google’s Gemma model across them at a glacial 0.39 tokens per second – in what Anthropic called the coming “digital slime mold.”
Co-author Daniel Freeman was even more breathless on X:
If you react to this by thinking it’s kind of sci-fi, that’s because I kind of think it is!
This is super weird!
We did not used to live in a world where little guys in boxes could replicate across networks, gobble up computers, reconfigure themselves to work better in the machines they find, etc etc— Daniel Freeman (@bucketofkets) October 12, 2026
His conclusion: “Regardless, whatever we do, they’re coming!”
Anthropic also tested whether models could run the entire replication cycle on their own: scan a network, hop to a new device, deliver the payload, get running, repeat. Exactly one succeeded:
“Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication.”
GLM-5.2 comes from Beijing-based Z.ai, formerly Zhipu AI. It spread to all 8 test nodes in four of five trials. The small-model workhorse in the rest of the experiments was Alibaba’s Qwen.
Neither name is new to Anthropic’s threat reports. As we noted last month, Anthropic says it disrupted industrial-scale “distillation” campaigns against Claude by seven China-based labs, and Alibaba and Z.ai were both on the list. As we reported in June, Anthropic took its Alibaba accusations straight to senators and White House officials. Fittingly, the “related content” box under Anthropic’s new post links straight to its latest piece on fending off distillation attacks.
