The end-of-2026 date in Anthropic's research is a projection from a trend line. The way in it used, an unauthenticated debugging port, is ordinary device hygiene a parent can check: turn debugging off on cheap Android TV boxes and unplug any that no longer get security updates.
Anthropic's worm test ran on emulated Android in a firewalled cloud network with the hacking step made trivial, and Anthropic calls it an upper bound. The end-of-2026 date is its own rough estimate from a capability index. Where Developer options sits varies by device, and off-brand boxes may not publish an update period. Sources checked 13 October 2026.
A replicating worm found on real home devices, or a test showing small models getting past authenticated ADB or unique passwords, would make the threat more than a projection. Evidence that off-brand boxes now ship with debugging off and published update periods would make the check less urgent.
Anthropic's 12 October 2026 research on AI that copies itself between home gadgets produced a run of smart fridge headlines. Start with the cheap boxes plugged into the telly instead. Write down every connected gadget in the house that came from a brand you can't name, off-brand Android TV boxes first. On each one, check that USB and wireless debugging are switched off and find out whether it still gets security updates. Any box that doesn't get updates goes in a drawer or gets replaced.
What follows draws on Anthropic's research post of 12 October 2026, coverage from Reuters and Al Jazeera on 13 October 2026, GOV.UK and Android's developer documentation, all checked 13 October 2026.
What Anthropic says it built
Anthropic researchers William Zhou and Daniel Freeman say they bought 15 off-brand Android TV boxes at about $55 each, networked them and ran Google's open Gemma4-26B-A4B model across them, with each box holding two of the model's layers in 4GB of RAM. Anthropic says it ran at 0.39 tokens per second.
The worm test was a separate experiment. Anthropic says it set up eight Google Cloud machines running an Android 15 emulator inside a firewalled private network, and let the worm hop from machine to machine through an Android Debug Bridge (ADB) port with no authentication on it. ADB is the tool developers use to control an Android device from a computer. Of the open models Anthropic tried, only GLM-5.2 completed the whole cycle of scanning for a target, getting in, sending itself over and getting a model running there, spreading to all eight machines in four of five runs. The model directing the worm ran on a separate server, because the test machines were too small to hold it.
Anthropic says it kept the hacking step trivial on purpose and calls the result an upper bound on real-world success. No worm ran on the TV boxes, and nothing in the post touched a real home network.
The frightening date is a trend line
The end-of-2026 date comes from a chart. Anthropic plotted small open models against a general capability index, drew a line through the best of them and says that line reaches GLM-5.2's level by the end of 2026. It calls this a rough estimate, since the index only stands in for replication ability. Reuters reports the same projection. Al Jazeera opens its story with smart TVs and fridges; Anthropic lists smart fridges, smart ovens, robot vacuum cleaners and lawnmowers as devices that could hold a slice of a small model, but it didn't test a fridge.
The part that isn't a projection is the open door. Anthropic points to Kimwolf, a botnet that it says infected over two million devices, mostly off-brand Android TV boxes running Android builds that their makers don't add security features to. It also notes that the Mirai botnet spread by trying lists of manufacturers' default usernames and passwords, so real home gadgets may not be much harder to get into than its trivial test.
My read is that the AI angle changes what a compromised box could be used for, and leaves the way in unchanged. A TV box with debugging open and no updates was already a bad thing to leave on the home network before anyone put a model on it, and the fix is the same dull housekeeping it has always been.
Switching debugging off on an Android box
Android's developer documentation says the Developer options screen is hidden on Android 4.2 and later until someone taps Build number seven times. USB debugging sits inside it, at Settings > System > Advanced > Developer options > USB debugging on Android 9 and later, and Android 16 adds Settings > System > Developer options > Wireless debugging. Google also says the screen may be in a different place or have a different name on some devices, which I'd expect on a box with no recognisable brand.
If Developer options shows up in Settings and nobody in the house turned it on, switch off USB debugging and wireless debugging, then turn off the main toggle at the top of the screen. Google says most options stop working when that toggle is off. I'd treat a box that arrived with debugging already on as one to replace, because it tells you how much care went into setting it up.
Checking whether a box still gets updates
GOV.UK says the UK's consumer connectable product security regime has applied since 29 April 2024. Under it, passwords must be unique to each product or set by the user, so a shared default password is out. Manufacturers also have to say how to report security problems, and publish the minimum period they'll provide security updates for, with an end date, in plain English and free of charge.
That end date is the thing to look for. Search the box's maker and model for a statement of compliance or a security update policy, and look in the box's Settings for a system update screen and the date of its last security update. If you can't find an end date, or it has already passed, unplug the box. I'd replace it with one from a maker that publishes its update period.
Start with the box under the telly, and if you can't find an update end date for it anywhere, unplug it before you read another fridge headline.
Sources
Anthropic, William Zhou and Daniel Freeman, AI models may be capable of self-replicating without access to a datacenter (12 October 2026). Reuters via US News, AI Models May Soon Self-Replicate Without Access to Data Centers, Anthropic Warns (13 October 2026). Al Jazeera, AI could self-replicate on home devices within 'months', Anthropic says (13 October 2026). GOV.UK, Department for Science, Innovation and Technology, The UK Product Security and Telecommunications Infrastructure (Product Security) regime. Android Developers, Configure on-device developer options. Checked 13 October 2026.