The Next Rogue AI May Not Need A Data Center - OpEd

Anthropic researchers demonstrated that a 26-billion-parameter AI model could be split across 15 inexpensive Android TV boxes and run at 0.39 tokens per second, proving distributed inference on consumer hardware is possible, though the system did not independently invade or self-replicate across other devices.

The finding, read alongside recent IoT botnet seizures, raises the question of how to contain an unauthorized AI agent once it runs on machines its developer does not control, since API keys and cloud shutdowns no longer apply.

The article argues that effective defense must shift to device owners, manufacturers and network operators through NIST-style baselines, mandatory update lifetimes, network isolation and clear separation of model capability from physical control.

Anthropic’s experiment with cheap television boxes and a new FBI botnet case expose a security problem no AI company can solve with a shutdown button alone.

Fifteen Android TV boxes, costing $55 apiece, ran a 26-billion-parameter artificial-intelligence model. Not quickly. Not elegantly. But they ran it without a data-center GPU.

This was a controlled experiment, not a hostile takeover of anyone’s television. Anthropic’s researchers reported the demonstration on October 12, with a speed of just 0.39 generated tokens per second. The achievement was modest in performance and significant in implication: computing resources scattered among inexpensive consumer devices can collectively host an AI model that would once have seemed to belong in specialized infrastructure.

Five days earlier, the Justice Department and FBI announced the seizure of hacking infrastructure allegedly used by China-linked actors. According to court documents described by the department, an existing botnet of compromised Internet of Things devices had supported reconnaissance against targets including an American electricity company and airports overseas. That operation involved conventional malware, not self-replicating AI. The two announcements are unrelated. Together, they raise a question the familiar debate AI shutdowns has barely confronted.

If an unauthorized AI agent can run on computers its developer does not own, who can actually stop it?

What the experiment did, and did not, prove

The phrase “self-replicating AI” invites a movie script. Anthropic’s results call for a much more precise description.

The researchers demonstrated that one model could be split across 15 purchased, networked Android TV boxes. They also tested whether agents could spread through a separate simulated network by discovering machines, transferring software and arranging for a model to run at the location. In that second experiment, a more capable model completed the simplified replication task.

But the successful agent used an external inference server . The simulated targets exposed an unauthenticated access route . And the system that actually ran across the cheap TV boxes was not shown independently invading other televisions, installing itself and continuing to replicate. In Anthropic’s own assessment, today’s small models still struggle to combine the necessary skills reliably, even though they can perform many individual steps. Its forecast of a more capable small model later this year depends on progress continuing. That is a projection, not an outbreak report.

Those limits matter because inflated warnings can damage the case for sensible preparation. A slow model running across devices proves distributed inference is possible under those conditions. It does not prove that anyone’s refrigerator has been seized or that every existing device-security control has failed.

Yet dismissing the finding would make a different mistake. The required ingredients are converging: capable open-weight models, cheap processors, connected consumer equipment and a long history of poorly secured devices being recruited into botnets. The new question is how much adaptive decision-making those botnets might eventually carry with them.

A June research preprint on adaptive computer worms provides another controlled example. Researchers demonstrated an AI-driven worm across an experimental network of different computing environments, using compromised computing resources to sustain its work. That was not evidence of an uncontrolled public attack. It did, however, show why local model execution changes the defensive problem.

A shutdown button cannot reach every stolen processor

When an AI service operates on a provider’s servers, the provider can potentially suspend its account, restrict its access or disable a deployment. Those controls are important. They are not a complete containment architecture for software copied onto devices outside the provider’s infrastructure.

An open-weight model running locally does not need to ask its original developer for permission each time it produces an instruction. Revoking an API key may accomplish nothing if the unwanted process is no longer using that API. Nor can a model developer necessarily see the household devices, cheap cameras or small-office computers on which copies might be running.

That does not make a distributed agent unstoppable. It means the relevant defensive authorities become the device owner, manufacturer, network operator, security provider and, where criminal activity is involved, law enforcement. Isolation, updates, credential controls and coordinated remediation remain possible. The difficult part is knowing which devices are involved, reaching their owners and keeping essential services working as the threat is removed.

This is not a hypothetical problem for ordinary botnets. In June 2025, the FBI warned that the BADBOX 2.0 network was using compromised streaming devices and other consumer electronics as residential proxies for criminal activity. Some products arrived compromised; others acquired malicious software through downloads. Their owners could still use them for their intended functions while their internet connections served someone else.

The computer need not look broken to be compromised. And the device’s legitimate purpose may have nothing to do with the attacker’s purpose.

The national-security boundary is not the household door

The October 8 Justice Department action makes the strategic link concrete. The department said the IoT botnet helped support vulnerability scanning against critical infrastructure. This was an allegation state-linked hacking activity and its supporting infrastructure, not evidence of an autonomous AI worm. It shows something simpler: inexpensive, dispersed devices can already be enlisted to support operations against nationally important targets.

A compromised TV box does not thereby gain access to a military command network. It does not automatically control a refrigerator’s thermostat, an industrial valve or a building’s fire protection. Running unauthorized computation, acquiring access to operational controls and defeating independent safety systems are separate accomplishments. Treating them as one is bad analysis and bad security planning.

The genuine risk is that widely distributed computing can provide reconnaissance, traffic relay, persistence or other support to campaigns directed at suppliers and essential services. If future agents can adapt across unfamiliar devices more effectively than scripted malware, the burden of defense could grow even when each compromised machine is weak.

The implication for defense procurement and infrastructure operators is not to inspect every family television as a weapons system. It is to make the devices attached to organizational networks accountable throughout their supported life, including those installed by contractors and facilities vendors. A camera, conferencing unit or remote-maintenance box should not become a forgotten computing platform simply because it performs a mundane job.

Defend the device and the network, not just the model

The technical starting point is not speculative. NIST’s IoT cybersecurity baseline calls for device identification, restricted interface access, authorized configuration changes, secure updates and security-state visibility. Those are the ordinary controls most relevant to a future unauthorized agent as well as to today’s scripted botnets.

Manufacturers should make support lifetimes visible before sale, disable unnecessary access by default and provide usable security updates. Institutional buyers should inventory connected equipment, restrict what it can reach and rehearse what happens when it has to be isolated. Internet providers and incident responders should plan for coordinated detection and customer notification, with appropriate privacy safeguards, rather than assume a single cloud company can terminate every hostile process.

The United Kingdom offers one useful regulatory precedent: its consumer-device security regime , effective since 2024, addresses default passwords, vulnerability reporting and the disclosure of minimum security-update periods. That is a baseline worth adapting, not proof that any country has solved IoT security.

Organizations introducing legitimate AI into operational equipment face an additional obligation. A communications or optimization component must not automatically inherit permission to alter a physical safety limit. If remote software is compromised, operators should be able to remove the unauthorized access while preserving safe local operation wherever the equipment permits it. Cutting power to an essential process can be more dangerous than disconnecting its management interface.

Finally, evaluation needs to distinguish model capability, available computing resources and successful unauthorized access . Anthropic’s experiment is valuable partly because it reveals where those components do not yet form a complete threat. Future tests should preserve that distinction and measure containment as well as replication: can defenders identify the process, isolate affected hosts, notify owners and prevent reinfection without unnecessarily disabling legitimate services?

The warning is not that household appliances have become conscious or that rogue AI is already loose in the suburbs. It is that the physical location of AI computing may no longer be the location where anyone has meaningful authority to shut it down.

A television can keep working for its owner while its processor works for an intruder. The AI safety boundary must account for both.