Anthropic Warns AI Worms Could Spread on Smart Devices

Anthropic says small AI models may soon copy themselves across cheap gadgets. Outside experts call it a forecast. Miami has security researchers on the problem.

Anthropic researchers say small AI models may be months from behaving like worms across cheap smart devices, though they have not shown a full rogue replicator. Outside experts urge caution. #Anthropic #Cybersecurity #IoT #AIWorms

Small AI models may be only months away from copying themselves across cheap smart gadgets, Anthropic says.

The warning came in a company blog post late Monday, AFP reported. It is a forecast, not an outbreak.

The concern follows a shift in where AI runs. Tech companies are building more powerful AI directly into phones, laptops, cars and household devices.

A worm would no longer need powerful data centers, Anthropic says. It could hop across cheap, poorly secured hardware such as smart TV boxes and kitchen appliances.

What Did Anthropic Actually Test?

Researchers William Zhou and Daniel Freeman based their math on Kimwolf. That botnet infected more than two million devices at its peak.

Most were off-brand Android TV boxes. Anthropic also names smart refrigerators, ovens, automatic vacuums and lawnmowers. Such machines could run a slice of a model under 30 billion parameters.

Anthropic says it has not shown a full rogue replicator. Models can finish single steps but still stumble when chaining them, Newsweek reported.

Two experiments stand out. In one, researchers split a 26-billion-parameter model across 15 cheap Android TV boxes. It ran, slowly.

In the other, a model called GLM-5.2 reached all eight virtual targets in four of five trials. It reached seven of eight in the other.

Anthropic made access easy on purpose, using an open debug port. It calls the result an upper bound on real-world success.

How Fast Could an AI Worm Spread?

Slowly at first. Anthropic says setup on low-powered devices could take more than a day, with doubling times measured in days.

Zhou and Freeman compared it to a slowly multiplying swarm of fruit flies.

Stamping it out would be hard, they say. There would be no central switch to turn off.

The estimate is rough, Anthropic said. It rests on one kind of gadget and one past botnet.

It also guesses that a small model could match GLM-5.2’s capability by the end of 2026. That figure comes from a general capability index, not a direct test.

Is This the Biggest Threat Today?

Not yet, outside experts say. Varun Chandrasekaran, an assistant professor at the University of Illinois, called the research unsurprising. He noted it has not been independently verified. He also said security on thermostats and home cameras “has historically been very weak.”

He sees people as the nearer danger. “A malicious human being is now supercharged with AI to perform bad things and we are seeing this happen at scale,” he said.

Nicolas Papernot of the University of Toronto led a team that built a prototype AI worm in June. It used freely available models.

He told AFP that a human still launches the agent.

Older worms exploited a fixed set of flaws. Papernot said AI can tailor an attack to each device, so fixing one hole no longer stops the spread.

Who in Miami Is Studying This Kind of Risk?

MAIN reported in September that FIU’s CIERTA studies adversarial machine learning, LLM security and model protection. The center wants to become South Florida’s cybersecurity research hub.

Local companies sell related defenses. MAIN profiled five Miami cybersecurity AI firms holding the line.

Faraday runs AI-powered penetration testing that probes systems “the way a real attacker would.” Arpia governs AI agents already inside company systems and keeps an audit trail.

Both address problems the worm research raises: attackers that adapt, and agents that act on their own.

John Walsh, a field CTO at IGEL, urged organizations to limit the blast radius. “Compromising one device must not allow an attacker to move freely across networks,” he told Newsweek.

Walsh added a caution. Compromising a device is not the same as gaining authority over its physical functions.

Anthropic’s warning is a forecast. The defenses on offer are familiar ones: update devices and limit how far one compromised gadget can reach.

Sources: