Relative Deterrence

October 14, 2026 — James Henry

Right now my home router has 52 devices holding active DHCP leases. On top of that there are at least ten headsets and assorted doodads that don't speak IP at all, but that something which does can reach, some reliably and some whenever they feel like it. From my desk I can see a fair number of other WiFi networks.

Now ask which of those an attacker would bother with. Probably none. Nobody is going to spend a week on taking control of my TV.

That feeling--that nobody is going to bother--is a security model. It's the oldest one we have, and in meatspace it's one of the most effective security models we have.

The Bet

The name for it is relative deterrence. You don't have to be secure. You have to be less worth the trouble than whoever's next. The lock on the shed doesn't stop a determined thief. It stops the lazy one, and there are a lot more lazy ones than determined ones.

Relative deterrence works and it works for a reason: an attacker is a person, and a person as an attacker has both a finite amount of time and a finite amount of resources. An attacker has to find you, get in, and work out what to do once they're there. Every minute spent on your shed door is a minute not spent inside a shed with no lock. So the attacker will move on to the easier shed, and you never find out you were ever on the list.

That's meatspace. In cyberspace botnets were the first crack in relative deterrence. Botnets don't care who you are and don't get bored. But a botnet is (relatively) dumb, scan adjacent /24s for known exploits A and B, skip a few, maybe pause a bit and try again. Botnets were written for one kind of device and one kind of hole, and they didn't have to figure anything out on their own.

What Anthropic Just Shared

On October 12, Anthropic's Frontier Red Team published a study of what happens when you put a model on that botnet's hardware. Not a model calling out to a datacentre. The model itself, running on TVs.

They bought fifteen off-brand Android TV boxes, about $55 each with 4GB of RAM apiece, networked them, and ran a 26-billion-parameter model across all fifteen. It ran at 0.39 tokens a second. That's roughly one word every two or three seconds, which is miserable, and it works.

Their question: can a small model set itself up on hardware it's never seen? Qwen3.5-9B got inference running on 8 of the 9 hardware types they tried, from a Jetson Nano to a Mac. In a simplified setup, one open-weight model, GLM-5.2, ran the whole chain: scan, get in, copy itself over, stand up inference, repeat. It reached all eight nodes in four of five runs. Their projection, if small models keep improving at their historical rate, is that they reach that level by the end of the year.

They're careful; they call it "signs of life," not a worm in the wild. The break-in step was trivial, no authentication on the port. They estimate full setup on the TV boxes at somewhere between 28 and 150 hours. Right now, in their words, the capability floor and the size ceiling don't intersect.

One more detail, in an aside. "Unlike many types of malware, weight-based replicators don't need root privileges." Inference runs in userspace, and a lot of these devices can simply be infected again after a reboot.

The Fruit Doesn't Care Where It Hangs

Relative deterrence says you don't have to be unbreakable, you have to be unattractive. It rests on one assumption: that the attacker has to choose.

The article's last section says it more politely than I will. Lightweight agents, it says, "may be much more willing than human attackers to put in the effort to compromise large fractions of the world's IoT compute." They're talking about IoT, because that's what they tested, but I honestly don't think that the category really matters.

An agent doesn't get impatient. It doesn't look elsewhere, because it can send a copy elsewhere and keep going here. The cost of another target is close to nothing, so there's no ranking of targets to be low on. "What's the point of taking over one TV?" is a human question, and a human answer to it is "none." An agent isn't weighing it that way. And it isn't one TV. If the TV can be owned, so can the headset, the watch, the phone, the baby monitor. Most of those can't run a model, but they don't have to. Each device is somewhere to stand, and a way onto the next (or back to the previous). Your home is both a compute resource and a long term persistence insurance policy.

The attacker also doesn't have to want anything from you right now. Low-and-slow persistence is cheap enough that a foothold is worth having whether or not there's a use for it yet.

The Anthropic article says "no root," not "ephemeral." But the reading follows: you don't need to own the machine, you need to run on it, and a thing that can quietly be re-infected after every reboot is a thing you can't clean once and forget. Imagine nuking and paving every device in your home, only for your bluetooth headset (or other non-obvious device) to be the persistence vector--you'd never find it.

The study sorts the threat into small IoT replicators, big datacentre replicators and API thieves, because that's how a defender sorts it. A Kimwolf-sized fleet of more than two million devices, split into groups of fifteen, comes to about 133,000 copies and "at most about 40 H100s-worth" of inference. A datacentre is how a human assembles that much compute and keeps it fed. It takes a lab to run Folding@home and a lot of volunteers who remember to leave the machine on. An agent swarm that designs its own redundancy has a different problem, and losing a third of the swarm to a bad firmware update is one it can shrug at.

None of this means the agent swarm can't be stopped, or that it's inevitable. The agent also decides when to start, and when to stop. Something has to decide to try, and that's a different question from whether it can. It means the thing that used to protect you, being further down the list, is gone. All the fruit was always a target. It just used to matter how low your particular branch was.

You Can't Be Fruit

So the comparative answer is done. There's no branch high enough.

The other answer is a different kind of answer. Not "I'm less attractive than my neighbour" but "I can't be a target at all." Provably, not probably.

That's what formal verification is, and it's where critical infrastructure is already headed. Milo Moses, in a long and mostly critical look at the Lean4 proof assistant, drops the sentence almost in passing: "Soon, we expect that the world's critical software infrastructure will be formally verified." What we should take from his analysis of the Lean4 space is the idea that code can be proven correct at all.

That changes the cyber security conversation: relative deterrence is about being a more difficult target. Proof is about not being a target at all. A piece of software that's been verified against a specification doesn't have a hole for the swarm to find (subject to the axioms underneath said spec). That is a different kind of statement from "we patched what we knew about," and it's one the existing security landscape doesn't tend to make.

Where That Leaves You

Your house isn't formally verified. Neither is mine, and neither is most of what's running anywhere. I don't know how fast proof spreads, whether the foundations hold up as it does, or what a swarm like this does when it meets a defender who's actually paying attention.

What I'm confident of is narrower. The bet most of us were making was that we weren't worth the trouble. That bet was priced in human attention, and for a while now the thing we're now pricing against doesn't use human attention.

James is a security engineer who has, so far as he is aware, never been all that interesting a target. He publishes at waypoint.henrynet.ca. This post was written with Claude, whose maker published the article it starts from.