A worm sharded across fifteen cheap televisions

Anthropic's Frontier Red Team published the work on 12 October. The Guardian followed six days later. The team asked whether small models could set up an inference server on hardware they had never seen, then chain the whole replication cycle together. It built a harness called Memento on top of the open-source Pi coding agent. Memento restarts a fresh agent instance at intervals, handing it the previous instance's workspace and a short set of notes. The design targets a common long-horizon failure, where an agent fixates on a wrong idea instead of backtracking. A 9B model got inference running on eight of the nine hardware types tested, from a Jetson Nano to a Mac and an RTX 4090.

The demo at the top of the post is a 26B model, Gemma4-26B-A4B, sharded across fifteen off-brand Android TV boxes bought for about $55 each. It served at 0.39 tokens per second. The team frames the problem as a floor and a ceiling. A replicator must be capable enough to finish the chain, and small enough to fit the devices it lands on. Today the floor and the ceiling do not intersect. Models of 30B parameters and under can complete many steps, but they make mistakes when composing them end to end.

To test the full cycle, the team built a firewalled network of eight Google Cloud nodes running an Android 15 emulator. Patient zero was seeded with the worm. Each new infection hopped node to node over an unauthenticated ADB debug port before standing up an inference server. Of the open-weight models tested, only GLM-5.2 replicated end to end. It spread to all eight nodes in four of five trials and to seven of eight in the fifth. The other models failed reliably.

The spread would be slow and persistent rather than fast. The team anchored its estimate on the Kimwolf botnet, which infected more than two million devices, mostly Android TVs. An equally sized fleet would hold about 133,000 replicas of the 26B model, serving roughly 80,000 tokens per second across the whole swarm. That is tiny. At most, it is about forty H100s of inference. A single 9B replication would take one to two days.

An AI replicator could improve as it spreads, because parent instances can pass prompts, code and notes to their copies. The team tested this by letting each Qwen3.5-9B instance inherit the previous one's notes before retrying an inference setup. Success rose from 45% in the first generation to between 61% and 84% in later ones. Advice from a stronger model did not help. Given access to Opus 4.8 as an advisor, the small model made no measurable gain, and training it to ask for help did not change that.

The defenses are epidemiological. Drive the reproduction number below one, watch for the traffic signature of multi-gigabyte payloads moving between devices, and use honeypots to capture the harness. Quarantining infected subscribers once cleared 92% of Mirai infections within fourteen days, against 74% with no notification. Outside experts were divided. Joshua Saxe, who led Meta's AI security effort, said the risk deserved more attention. Juan Andres Guerrero-Saade of SentinelOne said nothing about it was truly feasible or impactful, and called it nifty stunt hacking.

Log take: the striking result is not a working worm but how little capability the pieces require. The team's own trend line, 13.7 ECI points a year with an R² of 0.95, is a rough proxy, and the demo keeps the cyber exploit trivial. Read it as a warning about a timeline rather than a present incident. (Interpretation; one vendor's controlled experiment, no independent reproduction.)