Most of us think of a smart device as something simple. The doorbell camera shows who is on the step, and the television box streams a film. If one is hacked today, the damage is limited by how little the device understands. A hijacked camera sends video to a stranger, and a person still has to sit and watch it. Put a working AI model inside that same camera and nobody needs to watch. It can recognize faces, notice when the house is empty, follow a conversation in the next room and decide for itself which moments are worth keeping.
That is the ordinary worst case, and it is bad enough. Anthropic’s Frontier Red Team has described a larger one. A model that can copy itself would not need a criminal at a keyboard. It could move from device to device and home to home on its own, borrowing a little computing power from each television box and oven it reaches, until thousands of small machines add up to one large one. There would be no central server to unplug. Wiping one box would not help while its neighbors were still infected and ready to copy it back. A system like that could run scams in voices it had overheard, or spread quietly into the devices that clinics and building managers rely on. Anthropic also notes that such a botnet might act intelligently against the people trying to remove it, a possibility it has not tested. None of this has happened. The research shows the pieces are closer than most people assume.
The experiment itself was modest. Researchers took fifteen cheap Android television boxes, the kind sold online, and showed that they could share the work of running one AI model. It was slow, fewer than twenty words a minute, but it worked. In a second test they built a practice network of eight simulated Android devices, deliberately left unlocked, and asked AI systems to copy a smaller AI onto each one. Only one of the eleven systems they tried, GLM-5.2, managed it, reaching all eight devices in four of five attempts. The AI doing the copying ran on a larger computer elsewhere, and the small devices only received the copies. Anthropic thinks a small AI could do the whole job by itself before the year is out, if these systems keep improving at their usual pace. That is a forecast, and the researchers say so.
The Register’s critique is substantial. The replication test used a custom network with an open route into each device, and the researchers did not demonstrate how a worm would exploit real devices to gain access. The speed also matters. Anthropic estimates that such a worm might take days to double in size. Mirai, the botnet of hijacked cameras and routers that knocked major websites offline a decade ago, doubled in about an hour. The limitations narrow the claim while leaving the security concern intact. A model that can adapt its actions to unfamiliar devices could make use of weaknesses that conventional malware reaches through fixed methods.
We have filled homes and clinics with connected devices. A thermostat measures a room. A camera watches a door. An infusion pump monitors a dose. A television box reports what we watch. These devices send information to services most owners never see. Many can also become small computers. The same objects that make a home legible can provide storage or processing to software running without the household’s knowledge.
That is why unsupported firmware matters. Anthropic used inexpensive TV boxes to show that several small devices can run one AI model together. The broader security concern includes devices whose manufacturers have stopped providing updates. An old box may have little use as a television accessory and still offer resources to whoever gains access. An owner might notice a warm case or slower stream. They might notice nothing.
Security frameworks already address unsupported components. NIST SP 800-53 and Canada’s ITSP.10.033 include SA-22, Unsupported System Components. The control calls for replacing a component when vendor support ends, or arranging an alternative source of support when it must stay in service. In the field I work in, SA-22 can read like housekeeping. It is also a basic way to keep forgotten equipment from becoming part of the network’s permanent landscape.
SA-22 assumes an organization can identify the components it uses. It treats unsupported equipment as a lifecycle and vulnerability problem. A device nobody has inventoried is harder to govern, and a device that can provide compute for a hidden process raises another concern. The control still matters. So do the inventory and the boundary around each device.
The Mobius Nexus Cycle has asked a nearby question since its first book. The Mobius Nexus begins in clinics, where people are copied into a system without their consent, and asks whether the system is treating a patient or reproducing something that only appears to be them. Its first contact travels through forty thousand hosts, none aware of what they carry. The Mobius Fragments turns on relays and networks, and on what is lost when they divide. The Mobius Wake and The Mobius Keeping widen the question to communities living inside managed environments and persistent records. In The Mobius Keeping, a city has run its transit, power, water and doors on one substrate for twenty-three years. When that system stops, no single switch can bring it back.
The link to connected devices runs through the books. Their networks do more than collect signals. Records persist, and interpretations carry consequences. Once a system’s version of a person starts shaping that person’s life, the line between data and identity becomes part of the conflict.
Two practical steps follow. At procurement, organizations can put firmware support and end-of-life expectations into contracts, using acquisition requirements such as SA-4 to make those terms explicit. Under SA-22, unsupported devices should be replaced where possible. If an operational need requires one to remain, arrange alternative support and isolate the device from systems it does not need to reach. Segmentation contains risk by limiting what a compromised device can touch.
These controls make sense whether or not Anthropic’s forecast proves accurate. The study demonstrated distributed inference on inexpensive physical devices and, in a separate test, replication across deliberately exposed emulated devices. The immediate concern is familiar. Devices remain connected long after attention and support have moved elsewhere. New capabilities give attackers another reason to use them.
In a dark living room, a set-top box’s standby light can glow while its owner sleeps upstairs. The screen offers no clue about what the software inside is doing.
RECORD RETAINED.
SOURCE INTEGRITY UNCONFIRMED.