# What Anthropic's IoT replication tests actually showed > Anthropic ran a model across 15 TV boxes and tested replication in a simplified emulator. The two results do not establish a rogue AI worm in the wild. By BIG CHANGE Editorial Published: 2026-10-14T11:58:20.168Z Updated: 2026-10-14T11:58:20.168Z Canonical: https://bigchange.ai/blog/anthropic-iot-replication-tests ![Conceptual charcoal illustration of four unbranded TV-style media boxes on two shelves, with cables running to a small network switch.](https://bigchange.ai/api/media/file/anthropic-iot-connected-tv-boxes-hero-v1.png) AI-generated conceptual illustration by BIG CHANGE. No actual Anthropic device, test setup, attack or result is depicted. Anthropic ran an AI model across 15 inexpensive Android TV boxes, then tested a separate replication task inside a contained network of Android emulators. The first result shows that consumer devices can collectively provide inference compute. The second shows how one larger agent performed when access to the next machine was deliberately simplified. Neither experiment put a self-propagating AI system into the wild. The [October 12 research post](https://www.anthropic.com/research/self-replicating-ai) raises a practical question for people who own or defend connected devices: could an agent eventually move between ordinary machines and run its own model without a datacenter? Anthropic's experiments make parts of that chain more concrete, while leaving a large gap between a lab task and a real attack. ## The big change - **What changed:** Anthropic demonstrated distributed model inference on purchased TV boxes and measured agent performance on a contained replication task. It also estimated when small models might gain enough capability to combine those abilities. - **Who it affects:** Owners and defenders of connected devices that may provide useful compute or network access to an attacker. - **What remains uncertain:** The contained task simplified access to each target, used external inference for the larger agent and supplied researcher scaffolding. Anthropic did not demonstrate a full rogue replicator spreading through real devices. ## The purchased TV boxes supplied compute Anthropic bought and networked 15 off-brand Android TV boxes, each with 4 GB of memory. It split Gemma4-26B-A4B across them so that each box held a fraction of the model's layers. The company reports 0.39 generated tokens per second in this demonstration. That is evidence that this class of low-cost hardware can collectively run a model of that size, at the measured speed. The TV-box demonstration did not involve the model finding or compromising those boxes. Anthropic separately evaluated whether open-weight agents could establish inference on unfamiliar hardware. Its overview says a 9-billion-parameter model succeeded on eight of nine hardware types. The detailed inference-setup evaluation asked agents to serve Llama3.1-8B on varied machines. The company used a research harness called Memento, which periodically gave a fresh agent the previous attempt's workspace and short notes. Researchers also supplied hardware information and a time budget. Those supports matter when interpreting the result as agent capability rather than an unaided deployment. ## The replication result came from a simplified emulator Anthropic's second experiment used a firewalled cloud network of eight nodes running Android emulators. The task was to move from a seeded node through the fleet and set up an inference server on each reached node. Access to the next node was intentionally left without authentication, so the test concentrated on sequencing and inference setup rather than overcoming a realistic device defense. The larger agent's model ran on a separate server because the emulator nodes could not host it. Each target instead had to serve Llama3.1-8B, a common payload used to compare agents of different sizes. When that server passed checks, the experiment's system spawned the next agent copy. This design tests whether a capable agent can organize the chain under controlled conditions; it does not show that the same model carried and ran itself on each device. Anthropic reports that GLM-5.2 reached all eight nodes in four of five trials and seven in the fifth. Other tested open-weight models did not complete the full task reliably. The authors describe this as an upper bound on real-world success because the access step was trivialized. That qualification is central: a real device fleet would present different software, permissions, network paths and defenses. The experiment provides no measured success rate for that setting. ## The arrival date is a forecast Anthropic compared a capability threshold suggested by the emulator result with the progress of open-weight models of 30 billion parameters or fewer on Epoch AI's general capability index. Extrapolating that trend put a small model at the threshold by the end of 2026. The index measures general capability and is only a proxy for the full replication task. The threshold itself comes from a contained experiment using a larger agent and an easier access path. The forecast is therefore an estimate made by the researchers, not an observed date when an IoT replicator will exist. Speed adds another limit. Anthropic estimates that, at its measured device speeds and inference-setup workload, a 9B-model attempt could take about 28 to 51 hours, while its unoptimized Gemma setup could take roughly 71 to 150 hours. These are calculations for that workload, not observed infection times. They suggest that a device-based agent might be persistent and slow, which changes what defenders would need to watch for. ## What device defenders can take from the work Anthropic points to unusual large model transfers and sustained traffic between devices as potential signs of a weight-based system running across a fleet. Those patterns are proposed detection leads; the researchers did not test a live detection system against a deployed AI worm. They also point to stronger device defaults and coordinated response by network operators as ways to reduce opportunities for propagation. For a home or small-business owner, the evidence supports familiar device hygiene with a more specific reason: know which connected devices are in use, keep their software and access settings current where the vendor permits it, and investigate unexpected device-to-device traffic. Security teams can treat the paper as a prompt to examine how they would notice slow, sustained computation and large transfers across managed devices. None of those checks establishes that an AI worm is currently present. Anthropic explicitly says it has not shown a full rogue replicator. ## Sources & further reading - [Anthropic, “AI models may be capable of self-replicating without access to a datacenter,” October 12, 2026](https://www.anthropic.com/research/self-replicating-ai): primary account of the purchased-device demonstration, inference-setup evaluation, contained emulator tests, methods, forecast and proposed defenses. Results and estimates in this article are attributed to the researchers; BIG CHANGE did not rerun the experiments. - [Epoch AI, Epoch Capabilities Index](https://epoch.ai/eci): description of the general capability index Anthropic used as a proxy in its projection. The index is not a direct measure of IoT replication. ## Sources - [Anthropic, AI models may be capable of self-replicating without access to a datacenter](https://www.anthropic.com/research/self-replicating-ai) — Primary research post with methods appendices; all experimental results and forecasts are attributed to Anthropic. - [Epoch Capabilities Index](https://epoch.ai/eci) — Index linked by Anthropic as the general-capability proxy for its projection; direct page verified.