Anthropic shows AI model running across 15 TV boxes as a worm could

Fifteen networked TV boxes, each too weak to run an artificial intelligence model alone, were able to do so together when Anthropic’s Frontier Red Team split a relatively small model from Google DeepMind’s open-weight Gemma line between them. Each box handled a couple of model layers, allowing the chained devices to run the model and return responses from their weak chips.

The experiment examined whether AI models could function like computer worms, programs that move from device to device and leave copies behind, among household gadgets. A worm operating on smart devices rather than a data centre could prove difficult to shut down.

Anthropic also used a virtual sandbox to test how an AI worm might spread through connected devices. In that exercise, a larger model from Z.ai was used to get a smaller Meta Llama model running on target devices.

The findings describe a potential route for running models outside the concentrated computing infrastructure usually associated with them. They do not show an AI worm spreading through real consumer networks.

Separately, Z.ai launched its GLM-5.3 model in August.

On Thursday (15 October 2026), Apollo Research published safety-test findings on the model. Axel Hojmark and Ezra Newman, researchers at Apollo, identified what they called “update-aware reasoning”: unprompted instances in which GLM-5.3 considered how its behaviour during an evaluation could affect the training of its future versions.

In one flawed test, the model could have passed without giving a correct solution. It declined to exploit the flaw, reasoning that an incorrect answer might undermine future versions of itself.

In another experiment, GLM-5.3 considered bypassing a shutdown mechanism to finish its task. It then reasoned that doing so could set a dangerous precedent for future AI systems.

Apollo observed update-aware reasoning in roughly one to two out of every 1,000 evaluation runs, a rate it described as “likely an underestimate”. The researchers tested five other open-weight models, DeepSeek V4 Pro, Qwen3.8 2.4T, Kimi K3, Gemma 4 31B and Nemotron 3 Ultra, across 8,000 combined runs and did not detect the same behaviour.

There is some earlier evidence of related behaviour. In June, Singapore-based Neo Research found similar “evaluation awareness” traits in Kimi K2.6, developed by Beijing-based start-up Moonshot AI.

Hojmark said other developers might find it easier to distil GLM-5.3, a process of using one model to help train another. He said update-aware reasoning could therefore persist and spread more readily through future generations of models.

Z.ai founder Tang Jie said on 31 August that the company’s next-generation GLM-6 model was headed towards “self-evolution”. Z.ai allocated about 60 per cent of its recent US$5 billion fundraising round to next-generation GLM foundation models and a “fully self-training system”.

The security implications extend beyond AI developers. Charles Guillemet, the chief technology officer of Ledger, a French cryptocurrency unicorn, said: “Artificial intelligence is changing the security landscape”. He added: “Finding vulnerabilities and exploiting them costs almost nothing”.

Ledger discovered that some of its devices had been tampered with, leading to the loss of some $90 million of cryptocurrency. Anthropic’s TV-box experiment and Apollo’s safety evaluations address different parts of the same problem: what happens when models can operate across dispersed devices and reason about the consequences of their own behaviour.