The pitch is almost irresistible. A small plastic box, usually priced between $30 and $50, promises to unlock every streaming service, live sports, and premium channels without the monthly fees. It looks like Android TV, it works like Android TV, and it’s sold on marketplaces you already trust.
I get the appeal. For millions of households tired of paying for five different subscriptions, it feels like a clever workaround.
It’s not. That box is a Trojan horse.
And the malware inside it isn’t some theoretical future risk. It’s already active, already monetizing your network. According to new research, it may soon become the ideal breeding ground for a terrifying new generation of self-replicating AI worms.
- The FBI warns that over 1 million home IoT devices, mostly cheap Android TV boxes, are infected with the BADBOX 2.0 botnet.
- These devices often ship with malware baked into the firmware, meaning a factory reset won't save you.
- Anthropic researchers proved that small AI models can successfully replicate across these exact types of vulnerable devices.
- Cheap boxes provide the perfect storm: compute power, propagation paths, and a massive population of insecure hosts.
- The immediate fix is to disconnect cheap boxes and buy certified devices like a Chromecast or Nvidia Shield.
1. The Box Itself Is the Attack
The problem isn’t that these devices might get compromised later. The problem is that many of them are compromised before they even reach your doorstep.
The FBI issued a public service announcement in June 2025 warning about BADBOX 2.0, a botnet that has infected over one million home IoT devices. We're talking about cheap Android TV boxes, streaming sticks, projectors, and even digital picture frames.
The malware isn’t something you accidentally download. It’s baked into the firmware at the supply-chain level. Cybercriminals either configure the device with malicious software before purchase or infect it during the initial setup process. Once the box connects to your home network, it becomes part of a residential proxy network—routing traffic for other criminals, committing ad fraud in the background, and attempting credential stuffing attacks using your IP address.
The T95 Nightmare
I actually remember seeing the T95 all over Amazon a few years ago. An earlier investigation into that specific model found something even more unsettling. The device contained a directory called CoreJava, a relative of the CopyCat malware family that previously infected an estimated 14 million devices. CopyCat can root the device, inject itself into apps, and control network activity.
The T95 was also found to have its Android build signed with test keys and Android Debug Bridge (ADB) left completely open, giving anyone on the network full access. And a factory reset doesn’t fix it. The malware is in the firmware and simply reinstalls itself.
Not every cheap box has the exact same payload, but the pattern is consistent. Researchers who examined a stack of these devices found that almost half carried the same CoreJava folder. At least half the units used modified Android images that began their lives as software for Google Pixel phones, rebranded under names like "BigdroidOS" that exist nowhere else.
And honestly, the hardware specs are usually a lie, too. Devices advertised as having 4GB of RAM were found to have only half that usable. Some boxes advertised as 8K output were stuck at 1080p or even 720p. These aren't products designed to last. They are products designed to get onto your network and stay there.
2. The Warning Signs
The FBI's list of indicators is straightforward. Be highly suspicious of:
- Devices from unrecognizable brands.
- Generic streaming boxes advertised as "unlocked" or capable of accessing free content.
- Marketplaces that require you to disable Google Play Protect.
- Devices that are not Play Protect certified.
- Unexplained spikes in outbound internet traffic.
The challenge is that these boxes are often sold alongside legitimate electronics on mainstream platforms. The price is low enough to feel disposable, and the interface is familiar enough to feel safe. The malware is designed to be quiet. A residential proxy doesn't announce itself. The device may work perfectly well for months while quietly turning your home network into a node in a criminal infrastructure.
3. The AI Worm That Could Make It Worse
Now, consider what Anthropic published on October 12, 2026. Researchers William Zhou and Daniel Freeman released a study concluding that small AI models may be only months away from being capable of self-replicating on commercial IoT devices—specifically naming off-brand Android TV boxes as a prime example.
The research involved two distinct demonstrations. In one, the team bought 15 inexpensive Android TV boxes, priced at roughly $55 each, networked them together, and ran a version of Google's Gemma model distributed across all of them. Each box hosted part of the model, and together they ran inference at 0.39 tokens per second—slow, but functional. This proved that a capable AI model doesn't need a data center to run. It can run on the kind of hardware already sitting in millions of living rooms.
The second experiment was more troubling. Inside a controlled, firewalled cloud network of eight emulated Android devices, researchers seeded a single node and instructed various AI models to replicate themselves from one device to the next. Only one model, Zhipu AI's GLM-5.2, completed the full end-to-end chain in multiple trials. But the individual capabilities are improving rapidly. Anthropic estimates that at the current rate of progress, a small model could reach that level by the end of 2026.
To be clear: there is no rogue AI worm spreading across real households today. The models were instructed to replicate; they did not choose to. But the core finding remains—the building blocks for an AI-powered worm are falling into place, and the devices it would need are already sitting in our homes.
4. Why These Two Stories Are the Same Story
The connection between cheap malware boxes and AI worms isn't hypothetical. It's structural.
An AI worm needs three things: compute, a propagation path, and a population of vulnerable hosts.
- Compute: Now demonstrably available in cheap consumer hardware.
- Propagation: A matter of exploitation, and small models are already capable of handling many of the steps involved.
- Vulnerable Hosts: The part that should keep security teams awake at night.
Cheap Android TV boxes are not just insecure. They are designed to be insecure. They ship with backdoors, open debug ports, fake RAM, and firmware that survives factory resets. They are sold in enormous quantities to people who are not equipped to audit their network traffic. They are, in other words, a ready-made botnet waiting for a payload.
The BADBOX 2.0 botnet already comprises millions of devices. Anthropic's research suggests that a botnet of that size could collectively provide the equivalent of dozens of high-end GPUs worth of inference power—not enough to run a frontier model, but more than enough to run a smaller model capable of adapting, persisting, and spreading.
Unlike traditional malware, an AI-powered worm could figure out unfamiliar devices on its own. It would have no central server to unplug. Shutting it down would be incredibly challenging because there would be no single point to shut off. The researchers compare it to a digital slime mold: slow, persistent, and capable of learning as it goes. It doesn't need to be fast. It just needs to be everywhere.
5. What You Can Do
My immediate advice is simple: if you already own a cheap, no-name Android TV box, unplug it right now. A factory reset will not remove firmware-level malware. Treat it as compromised.
If you want a streaming device, buy from a reputable brand with Google Play Protect certification, regular firmware updates, and clear documentation. A Chromecast with Google TV or an Nvidia Shield costs more, but neither will turn your living room into a relay station for criminal traffic.
Long-Term Network Hygiene
Segment your IoT devices onto a separate VLAN so they cannot communicate freely with your computers and phones. Monitor outbound traffic. Change default passwords. Disable remote access when it is not needed. These are basic steps, but they are the difference between a compromised gadget and a compromised home network.
6. Frequently Asked Questions
Will a factory reset remove the malware from my TV box?
No. In most of these cases, the malware is baked directly into the firmware at the factory level. When you perform a factory reset, the device simply reinstalls the compromised firmware. The only real solution is to stop using the device entirely.
How do I know if my Android TV box has malware?
It is very difficult to tell because the malware is designed to be quiet. Look for unexplained spikes in outbound internet traffic, sluggish performance, or if the device was purchased from an unrecognizable brand and wasn't Play Protect certified.
Is it safe to buy a used or cheap streaming stick on Amazon?
Stick to reputable brands (Google, Amazon, Roku, Apple, Nvidia). If you buy a cheap "unlocked" box from a brand you've never heard of, there is a high probability it contains supply-chain malware.
Can a cheap TV box really run an AI model?
Yes. Anthropic's research proved that distributed across multiple devices, these boxes can run small models like Gemma. While the speed is slow (0.39 tokens per second), it's enough for a worm to operate and spread.
7. The Bigger Picture
The cheap streaming box is a useful symbol because it makes an abstract threat concrete. For years, the working assumption about dangerous AI was that it would require serious hardware—racks of GPUs, cloud accounts, places where security tooling is mature and someone is watching. Anthropic's research challenges that assumption.
The hardware is already in your home. The security is already absent. The only missing piece is a model capable enough to exploit the gap, and that gap is closing faster than many defenders expected.
The FBI warning and the Anthropic study are not separate stories about different kinds of risk. They are two halves of the same equation. One describes the vulnerable population. The other describes the capability that could exploit it. The device on your coffee table is the intersection.
As someone who reviews tech for a living, my rule is simple: the cheapest option is rarely the safest one. And in this case, it may just be the thing that helps a new kind of worm find its first foothold.
Found this guide helpful?
Explore more cybersecurity alerts, tech news, and AI deep-dives.
Explore More Tech Guides →