Could AI copy itself onto a cheap TV box? Not yet, says the lab that tested it

What did Anthropic actually test?

2 things: whether cheap gadgets can run a capable AI model at all, and whether a model could set itself up on a device and then move on to the next.

• Can gadgets run it? Yes, slowly. A model spread across the 15 TV boxes ran at 0.39 tokens per second¹. A token is a word or a piece of a word, so that is well under 1 word a second.
• Can a model copy itself along? In a closed test network of 8 emulated Android devices, each model had to find the next device, move in and get an AI model working there. Of the openly available models tested, only 1, called GLM-5.2, managed the whole cycle reliably¹.

So can it happen today?

No. In Anthropic’s own words: “We don’t yet have a full rogue replicator”. The model that could do the job is too big for the gadgets, and the models small enough couldn’t do the job.

The report is frank about its limits¹:

• The break-in was made easy on purpose. The test devices had an open door with no password check, which Anthropic says makes its result “an upper bound on real-world success”.
• The capable model did not run on the gadgets. It ran on a separate server, because the test devices were too small for it. As the report puts it, “the floor and ceiling don’t intersect”.
• It would be slow. For a small model, each copy would take more than 1 to 2 days. Anthropic compares it to “a slime mold or a swarm of fruit flies”.
• The timing is an estimate. On the current trend, a small enough model reaches that level by the end of 2026. Anthropic calls this “only a rough estimate”.

What should a business take from it?

An old lesson with a new reason: don’t leave cheap smart devices on your office network with their factory settings.

Nothing here calls for alarm. It does point at a corner of the network that is easy to forget: the TV box in the meeting room, the cameras, the conferencing unit, the storage box under a desk. Anthropic notes that past attacks on devices like these spread by nothing cleverer than trying “a default list of manufacturer usernames and passwords”¹.

So, 4 small jobs:

1. List the smart devices on your network. If nobody knows what a box is for, find out or unplug it.
2. Change every default password.
3. Keep them updated, and replace the ones that no longer get updates.
4. Put them on a separate network from the systems that hold your business data.

That list is our advice, built on the report’s point about default passwords. The report adds that makers can shrink the problem too: in the UK, default passwords on such devices are now non-compliant¹.

The TV box is not plotting anything. It would simply do better with a new password. And for the AI you connect to your systems on purpose, the same thinking applies: limit what it can reach.