Anthropic’s Frontier Red Team just published research showing an open-weight model running, and in simplified tests replicating itself, across cheap consumer hardware. No cloud required. The report, by William Zhou and Daniel Freeman, argues that small open models may be months away from being able to self-replicate across commercial IoT devices (AI Weekly; The New Stack).
The headline experiment sounds almost harmless. The team bought fifteen off-brand Android TV boxes at roughly $55 each and split a model, Gemma4-26B-A4B, across them. It ran at about 0.39 tokens per second, which is less than half a token each second. That sounds harmless until you do the math.
Do the math
A short email is about 200 tokens. At 0.39 tokens per second, a cluster of fifteen boxes composes one in roughly eight and a half minutes.
Now look at how big real botnets get. The researchers point to the Kimwolf botnet, which peaked at more than 2 million infected devices, mostly cheap Android TV boxes. They estimate a pool that size could host around 133,000 concurrent copies of the model. At one short email every eight and a half minutes per copy, that is close to a million emails per hour, written by agents that can reason and adapt.
And email is the expensive case. Agents do not need to write much to have a large impact. A tool call such as run this command, scan this network range or send this file is a few dozen tokens, not hundreds. An agent choosing its next action can get a lot done at half a token per second.
We expect a future awash with agents running on all types of hardware, including some that aren’t under human control.
Anthropic Frontier Red Team, as reported by AI Weekly
From dumb bots to thinking ones
In 2016, the Mirai botnet knocked major websites offline with hijacked cameras and routers that did one dumb thing: flood servers with junk traffic. Mirai spread by trying default passwords. It could not adapt, pick targets or change tactics.
Now imagine those same devices running agents that can read a network, choose what to attack next, write convincing messages, and copy themselves onto the next vulnerable box without a central command server telling them what to do. That is the shift this research points toward: from botnets that follow instructions to swarms that make decisions.
What the research actually showed
It is worth being precise, because the details matter for how you respond:
- Of eleven open-weight models tested, one, GLM-5.2, completed full end-to-end replication, reaching all eight target nodes in four of five trials on emulated devices.
- A smaller model, Qwen3.5-9B, set up inference on most hardware types and improved as it passed notes to its own copies, but did not complete full propagation chains.
- Each replication cycle took from about a day to several days per device.
- The break-in step was deliberately simple: devices exposed an unauthenticated debugging port (ADB).
Critics have called the framing alarmist, and some point out that the test devices were purpose-built to be insecure. That is a fair caveat, and it is also the most useful takeaway: the attack works because the devices were left open. Millions of real devices ship exactly that way today.
If you build or ship IoT, start here
- No default credentials, ever. Unique per-device secrets set at manufacturing or first boot.
- Close the debug doors. ADB, Telnet, SSH and admin panels off by default in production firmware.
- Signed, automatic updates. A device you cannot patch is a device someone else will eventually control.
- Least privilege on the device. Firmware that cannot download and execute arbitrary binaries is a much harder host for a replicating agent.
- Watch the compute. Sustained, unexplained CPU and memory load on a cheap device is a new signal worth monitoring.
If you run a network full of devices
- Inventory every connected device, including TV boxes, cameras and conference-room hardware.
- Segment IoT onto its own network with no path to business systems.
- Block unexpected outbound traffic and peer-to-peer connections from device networks.
- Prepare for AI-generated phishing that reads well and arrives at scale: verification steps beat spotting typos.
The bottom line
Agentic botnets are not here yet, but the building blocks are getting cheaper every quarter. The defenses are not new. They are the basics that stopped Mirai, applied before the attackers can think for themselves.
If you build connected products or manage a fleet of devices and want a security review with AI-era threats in mind, talk to our team.