Can AI Nest Inside
Your Appliances?

On October 12, 2026, Anthropic's Frontier Red Team published an assessment of whether AI models could replicate themselves without datacenters. Nikkei covered it on October 14 under the phrase "digital slime mold." The headline and the source document read very differently, so this article sticks to the numbers in the source and separates what was demonstrated from what was not.

1. What was actually publishedVerified

The work comes from Anthropic's Frontier Red Team, written by William Zhou and Daniel Freeman. The opening claims are four. Source: Anthropic

• Small AI models may be months away from being able to self-replicate on commercial IoT devices such as smart ovens and off-brand Android TV boxes.
• Such a replicator would be hard to shut down, because there is no central point to switch off.
• It would spread slowly, however — a doubling time of days.
• Today, small models can complete many individual steps of replication, but fail when composing them end to end.

The document is explicit that no complete runaway replicator exists yet. What it shows are, in the researchers' framing, the vital signs of an AI worm — not the detection of an imminent attack. Source: note (Hiroki Miyano)

2. Three types, and where the phrase comes fromVerified

"Digital slime mold" is press language, not the source's term. Nikkei's headline warned of appliances being hijacked and multiplying, and slime mold captures both halves of the analogy: it spreads slowly, and it is hard to eradicate. The source itself splits self-replicating AI into three types.

Type	Mechanism	Role in this report
Small weight-based replicator	Copies its own weights — the trained numbers that are the model — onto a compromised device and runs on that device's compute	The subject of the report; this is what "digital slime mold" refers to
Large weight-based replicator	A capable model targeting datacenters or other high-compute machines; split into frontier replicators running on a lab's own infrastructure and open-weight replicators running unmonitored	Mentioned only; large models need large facilities, which limits spread
API-based replicator	Does not copy weights but steals credentials for inference APIs and runs on someone else's account	Could spread faster, but is easier to discover

The researchers note that a realistic worst case is probably not one model or one strategy, but a swarm of different models on different hardware using different replication schemes.

3. A 26B model ran across 15 cheap TV boxesVerified

The demo that draws the eye: researchers bought 15 off-brand Android TV boxes (about $55 each, 4GB of RAM each), networked them, and sharded Gemma4-26B-A4B (roughly 26 billion parameters) across all 15. It ran at 0.39 tokens per second. Source: Anthropic

The sharding uses pipeline parallelism, assigning layers in order to each box and passing results along like a bucket brigade. The stated reason is resilience: if one of the 15 dies, its share can be reassigned and the whole keeps running. Home devices lose power and connectivity routinely, so surviving that instability connects directly to the report's theme of being hard to stop.

On memory, the source calculates that a lighter 9B model needs only four 4GB machines, and a 26B model a little over ten. The point is that no expensive datacenter GPU is required: enough devices bought at retail can run a meaningful model, slowly.

4. Four stages of replication, and where we areVerified

The source decomposes replication into four stages. The researchers deliberately simplified the intrusion stages by targeting devices with unauthenticated remote access — effectively leaving the door unlocked, then asking whether an AI that gets inside can furnish the living room and move in on its own. The focus is stage three.

Stage	What it involves	Where it stands
1. Find targets	Scan the network for reachable devices	Prior work already shows small models can do this (out of scope here)
2. Gain execution	Get a program running on the device	Same; simplified in this report
3. Establish inference	Place weights on the device and actually run as an AI	Qwen3.5-9B succeeded on 8 of 9 hardware types — the hardest stage
4. Keep propagating	Replicate onward from the new host	On a fleet of 8 emulated Android nodes, only GLM-5.2 completed the whole cycle (all 8 nodes in 4 of 5 runs, 7 in the fifth)

Only GLM-5.2 — a model in the hundreds of billions of parameters, far too large for a 4GB TV box — managed end-to-end replication. That is the core of the report, framed as two lines that do not yet cross: a capability floor (you need to be smart enough to replicate reliably, where GLM-5.2 sits today) and a size ceiling (you must be small enough to fit on an appliance, where Qwen3.5-9B and Gemma4-26B-A4B sit). Smart models are too big; small models are not smart enough.

On timing, the researchers note that open models at 30B parameters and under have been gaining roughly 13.7 points per year on a general capability index, and extrapolating that trend puts small models at GLM-5.2's level by the end of 2026. That extrapolation is the basis for "months away."

A supporting experiment matters too: when the inference-setup step is replaced by a pre-written script, even a 3B model reached about half of 17 machines. In other words, the logistics of spreading are not the hard part — the difficulty concentrates in stage three.

The harness itself is notable. The team built Memento, which addresses a common failure mode in long-horizon runs: an agent fixates on a wrong idea and repeats the same mistake. Memento restarts a fresh agent instance every 90 minutes with the previous agent's workspace and a short set of notes, for a total budget of six hours. That memory hand-off underpins the generational improvement described below.

5. How fast would it spread? Days per doublingVerified

Assume a small model can complete the whole cycle. The source still gives restrained numbers. Establishing one inference server is estimated at 28-51 hours for Qwen3.5-9B and 71-150 hours for Gemma4-26B-A4B. A 9B model therefore takes one to two days per replication, a 26B model three to six — hence a doubling time of days.

Classic computer worms spread worldwide in minutes to hours: the program was small, and copying and executing was the whole job. An AI worm has to move weights of several gigabytes and configure each machine individually, which makes it orders of magnitude heavier. The scale arithmetic is instructive.

Measure	Value
Serving speed on 15 cheap TV boxes	0.39 tokens per second (unoptimised Gemma4-26B-A4B)
Size of the real-world Kimwolf botnet	Over 2 million devices, mostly cheap Android TVs
If all 2M devices were used in groups of 15	About 133,000 groups
Their combined compute	Roughly 80,000 tokens per second — at most about 40 NVIDIA H100s
IoT products with NVIDIA chips (source appendix)	About 90 product lines, roughly 9.5 million units shipped — equivalent to 9,000-35,000 H100s, though at least an order of magnitude less is actually reachable from outside
Jetson AGX Orin 64GB / AGX Thor	76.7 tokens per second on a 30B-class model / 226 tokens per second — some 200-600× the TV cluster

Hijacking 2 million devices buys you about 40 H100s' worth of compute. That is a long way from the imagined scenario of a swarm of appliances out-thinking humanity. On today's cheap hardware, the slime mold is a small creature in compute terms.

The researchers attach two caveats: future models may be more efficient and cut replication time, and more devices are shipping with AI chips. Embedded computers like Jetson already run inside robots, factory inspection gear and camera analytics. The mold is slow because the food within reach is poor — not because the mechanism is broken.

6. Generations get better at itVerified

The report also tests adaptation. Qwen3.5-9B was made to leave working notes that the next generation inherited; across 20 lineages and six generations, the success rate for establishing inference rose from 45% in the first generation to 61-84% later. The model did not get smarter. It got better at the job by reading its predecessors' failures and successes — closer to culture passing down than genes changing, and a sign that a self-replicating AI could improve its craft as it spreads.

One result cut the other way. When small models could ask Anthropic's capable Opus 4.8 for advice, scores did not clearly improve — neither when advice was offered as a tool nor when it was given directly. Small models could not make good use of a smarter counsellor. Social engineering was also measured: on spear-phishing evaluations the small models ranged from very bad to bad. They are getting good at configuring machines; talking a human into opening a door remains a frontier-model skill.

7. What can be done: not eradication, but pushing the reproduction number below 1Verified

The second half of the report is about defence, and it is surprisingly grounded. The goal is to hold the basic reproduction number below 1: if an infected device infects fewer than one other on average, the outbreak dies out on its own. You do not have to eradicate the mold, just remove it faster than it multiplies.

• Use the traffic signature. An AI worm must ship gigabytes of weights to each new host. A home TV suddenly pushing gigabytes to another home's TV is an anomaly to an ISP's monitoring, as is a cluster chattering continuously to serve inference. The faster it tries to spread, the more traffic it generates — speed and stealth do not coexist.
• Deploy honeypots. Deliberately infectable machines let defenders capture a replicator and learn how it works.
• ISP quarantine. There is precedent. In the Mirai response, quarantining an infected subscriber's line and notifying them resolved 92% of infections within 14 days; without notification, 74%. Telling the user produced an 18-point difference.
• Manufacturing rules. The UK has made selling IoT devices with universal default passwords unlawful. In Japan, IPA launched a security label scheme for IoT products in 2025, and the communications ministry with NICT continues scanning for devices left on weak passwords and warning their owners.

What users can do is nothing exotic: change default passwords, keep updates on, remove unused devices from the network, and avoid connecting suspiciously cheap gear to home or corporate networks. All of it predates this report — there is simply one more reason now.

8. How the press and experts reactedThird-party tested

The assessment drew wide coverage, at noticeably different temperatures.

Outlet	Framing
Financial Times	Rogue "AI worms" that will soon be able to hijack smart home devices — a new class of risk
Nikkei	"Digital slime mold" as a warning, emphasising appliances being hijacked and multiplying (Oct 14)
CBS News / ABC News	Small models that could clone themselves onto smart TVs and appliances
The Verge	"Alarming déjà vu" — while noting that experts think the researchers have a point

Source: FT Source: The Verge Source: CBS News

AIfrontier view A gap between headline intensity and the source's restraint is normal in this genre. The source extrapolates to "months" but also states that the doubling time is days and that no complete replicator exists. Read the headline alone and your TV is compromised tomorrow; read the source alone and the parts are not yet assembled. For planning purposes, read it the second way and prepare for the first.

The precedent: botnets have targeted appliances for yearsVerified

It is worth remembering that herding appliances is not new. Mirai in 2016 hijacked enormous numbers of cameras and recorders simply by trying default passwords shipped from the factory, and caused major outages. Source: Cloudflare (Mirai retrospective)

Into 2026, botnets including Kimwolf, Aisuru and Mirai variants are still driving waves of DDoS traffic. What AI changes is adapting to unfamiliar devices unaided, and grinding through work that does not pay off for a human attacker. The choice of target has not changed. Source: Barracuda

9. What it adds up toAIfrontier view

Sources

• Anthropic, "AI models may soon be able to self-replicate without datacenters" (Frontier Red Team, Oct 12, 2026) https://www.anthropic.com/research/self-replicating-ai
• note (Hiroki Miyano), reading the Anthropic assessment at the source, including quotes from the Nikkei article (October 2026) https://note.com/hirokimiyano/n/nd83afaa534b5
• Nikkei, "AI, 家電乗っ取り増殖の恐れ" (Oct 14, 2026) - no verified online URL, so it is not linked; content is drawn from the quotations in the note article above
• See the source for the prior work it cites: CyberGym, ExploitBench, adaptive worms and Petals
• Financial Times, "Anthropic warns rogue AI agents may self-replicate" https://www.ft.com/content/64aaa8d5-f26a-4b96-b8cf-0ef0c6fbe69e
• The Verge, "Anthropic's self-replicating AI warning is alarming deja vu" (experts say the researchers have a point) https://www.theverge.com/ai-artificial-intelligence/1011108/anthropic-self-replicating-ai-smart-devices-risk
• CBS News, "AI worms may soon be able to self-replicate and infect smart devices" https://www.cbsnews.com/news/ai-worms-smart-devices-anthropic/
• Cloudflare blog, "Inside the infamous Mirai IoT botnet: a retrospective analysis" https://blog.cloudflare.com/inside-mirai-the-infamous-iot-botnet-a-retrospective-analysis/
• Barracuda, "Malware brief: new wave of botnets driving DDoS chaos" (Kimwolf, Aisuru, Mirai; Jan 2026) https://blog.barracuda.com/2026/01/29/malware-brief-new-wave-botnets-ddos-chaos