Anthropic’s Frontier Red Team has moved one replication assumption out of the datacenter. It ran a 26-billion-parameter model across 15 off-brand Android TV boxes, each costing about $55, at 0.39 tokens per second. That is roughly $825 of hardware and one generated token every 2.56 seconds, by simple arithmetic. A 9-billion-parameter model got inference running on eight of nine unfamiliar hardware types.
The result is easy to exaggerate. Anthropic largely brackets the exploit stages — finding a vulnerable device and gaining execution — and concentrates on setting up inference after access. The public-internet worm has not been demonstrated. Models of 30 billion parameters and under completed many individual steps, but composition remained the harder part; only stronger systems completed the simplified end-to-end cycle.
The important change is architectural. Slow intelligence distributed across cheap, heterogeneous devices is not a substitute for a datacenter when speed matters. It may be enough for persistence, adaptation and continued propagation when there is no single machine to shut down. Defenders therefore need to test the inference-installation step separately from exploit capability, because success in one does not establish success in the other.