An AI that copies itself onto your TV box, is it coming soon?

You know, that little no-name Android box you bought for 50 euros on the Internet to watch your movies on the old TV in the bedroom? Anthropic bought fifteen of them. Not to watch Netflix: to see whether an AI could install itself on them, run itself there, then jump to the next box without anyone holding its hand. And the answer, published on October 12, sends a bit of a chill down your spine: not yet, but maybe in a few months.

Fifteen $55 boxes, and an AI running on them

The study comes from Anthropic's Frontier Red Team, the company that makes Claude. A “red team” is a team paid to play the bad guys: it attacks its own systems, and those of others, to find the holes before the real hackers do. Anthropic is also the company that lent its vulnerability-hunting AI to hospitals last week, so we're staying in the family. This time, William Zhou and Daniel Freeman asked a question that sounds like science fiction: can an AI copy itself all by itself, without a data center, onto the devices we all have at home?

What does an AI on fifteen TV boxes look like?

Big AIs like Claude or ChatGPT run in warehouses filled with graphics cards costing tens of thousands of euros each. But there are also small models, which you can download freely and run at home. Those are the ones that interest the researchers, because a hacker can copy them wherever they want.

So they took fifteen Android boxes costing around $55 each, with 4 GB of memory each, and cut up a Google model, Gemma 4, into slices: two layers of the “brain” per box, with each box passing its piece of the calculation to the next one, like a bucket brigade passing buckets along. It works. Slowly, very slowly: 0.39 “tokens” per second, a token being part of a word. In plain English, about one word every three seconds. For chatting, it's unbearable, you have time to go make yourself a coffee between two sentences. For a program working quietly while you sleep, it's more than enough.

Copy itself all by itself, meaning what?

The researchers divide the work into four stages. Find a device to infect. Get inside it. Run the model there, which is the hardest part on unfamiliar hardware. And move on from there to the next one. A classic computer virus does the same thing, except that it follows an instruction manual written in advance for a specific device. An AI, on the other hand, can manage when faced with a device it has never seen.

And the results are clear. Qwen 3.5, a small model from Alibaba, managed to run itself on eight types of hardware out of nine, from a little hobbyist's computer to a Mac. On a closed network of eight machines, GLM-5.2, a Chinese model available for free download, completed the full loop: it reached all eight machines in four out of five attempts, and seven out of eight on the fifth. The other models tested failed. The smaller ones know how to do each stage separately, but they mess up when they have to chain them all together.

Two details made me smile. When each copy leaves notes for the next one, like “I tried this, it doesn't work”, the success rate goes from just under one time in two to six, even eight times out of ten over the generations. The AI learns from its ancestors, like a colony. And when the researchers gave the small models a luxury adviser, Claude Opus 4.8, whom they could ask questions, it changed almost nothing: the small ones didn't know what to ask it! Like the intern who has the company's best expert sitting next to him and doesn't dare open his mouth.

The back door was wide open

Before panicking, you have to read the small print, and Anthropic says it itself in black and white. To get into the boxes, the researchers took the easy route: a service door called ADB, intended for Android developers, which lets you control the device remotely. On many cheap boxes, it comes open, without a password. The team says it itself: that makes its result “an upper bound” on what would work in real life.

Three padlocks on the door, and the cat flap open right next to them

Except that, and this is where I get stuck, real life isn't much harder. In 2016, the Mirai virus infected hundreds of thousands of cameras and video recorders simply by trying factory passwords, things like "admin" and "1234". With this army of hacked devices, what is called a botnet, it took down Twitter, Netflix and a good part of the American web for hours. Home security cameras! And the most recent one, Kimwolf, passed two million infected devices, mostly no-name Android TV boxes. Exactly the ones in the test.

Slow, leaderless, and hard to shut down

The researchers did the math with those two million boxes. Enough to run around 133,000 copies of Google's model at the same time. It sounds huge, but all added together, that represents at most the power of about forty large data center graphics cards. A small data center, free for the hacker since you're the one paying the electricity bill.

The real problem isn't the power, it's that there would be no off switch. No central server to unplug, no leader to stop. Anthropic compares it to slimy mold or fruit flies: it moves slowly, with the number of copies doubling in a few days, but it gets established everywhere and clings on. Charming.

No central brain, and yet it links everything lying around

And when? The researchers looked at the speed at which small models have been progressing for years. If the curve continues, a small model will reach the level of GLM-5.2 before the end of 2026. The title of their article says "maybe", incidentally, and they talk about "signs of life", not a worm that exists. Nobody has seen such an AI wandering around in the wild to date.

Okay, so what does it change for me?

At home, between my Jeedom home automation system and the little Shelly module I slipped behind the garage switch, there are already quite a few connected gadgets running day and night. And I'm not a special case: the internet box, the TV, the robot vacuum, the doorbell, sometimes the oven. All these little things are computers, even if they don't look like it.

Avoid cheap no-name TV boxes. Not because they're Chinese, but because nobody updates them, and some come out of the factory with their service door open. A box from a well-known brand, or your operator's stick, costs a little more and receives patches. Change the factory passwords on everything that has one, the camera, the router, the doorbell. And if a device hasn't received any updates for years, unplug it from Wi-Fi. Your old 2015 media player doesn't deserve your trust!

There's also a safety net that doesn't depend on you. An AI that copies itself has to send files several gigabytes in size from one device to another, and your internet provider can spot that. Back in the Mirai days, when operators warned their customers that a device was infected, more than nine out of ten infections disappeared within two weeks, compared with three out of four without a warning. That's exactly what Anthropic is asking for: operators should monitor this weird traffic and warn people, and manufacturers should stop shipping open doors. In the United Kingdom, the law already bans selling a connected object with the same factory password for everyone.

The kind of message that saves your evening, and the neighborhood network

The timeline, honestly? Maybe a few months before the models are capable of it, according to Anthropic. But between "capable in a lab, with the door open" and "epidemic in living rooms", there's some distance, and that's precisely why these researchers are publishing now, before the problem exists, to close that gap. Mirai caught everyone off guard in 2016. This time, at least, we're warned.

Should we be afraid?

Not yet. And frankly, I'd much rather have an Anthropic team buy fifteen boxes online to test this than some smartass in a basement, because at the end of the day the manufacturers and operators now have a list of things to fix, with numbers. Whether they'll read it remains to be seen.

Because what bothers me is the price. A $55 box, nobody monitors it, nobody updates it, you forget it behind the TV for ten years. And it's precisely what we forget that ends up working for someone else. So tonight, go take a look behind your TV: if you find a box there whose name you don't even remember anymore, you know what you need to do!

Sources

• Anthropic Frontier Red Team, William Zhou et Daniel Freeman, 12 octobre 2026 : AI models may be capable of self-replicating without access to a datacenter
• The New Stack, 13 octobre 2026 : the experiment with the fifteen TV boxes
• GBHackers: Anthropic warns that models could copy themselves onto connected devices
• Wikipedia: Mirai, the 2016 connected-device botnet

Article written with the help of Claude Code, proofread and corrected by me.