Anthropic says AI worms may be close — and cybersecurity experts are taking it seriously

Anthropic says its latest research suggests small AI models could soon power self-replicating malware that moves across connected devices, and outside experts say the warning should not be dismissed. The company’s experiments do not prove a real-world “AI worm” is already loose, but they do show that parts of the problem are becoming technically feasible — which makes poorly secured smart devices a more serious cybersecurity concern.

The research, published this week, focuses on whether AI systems can be broken into smaller pieces, spread across low-powered consumer hardware and used to automate the steps needed to copy themselves. Anthropic argues the answer is increasingly yes, especially as smaller models get better and cheaper to run. Security researchers interviewed about the findings agreed that while the leap from lab demo to wild infection remains large, the underlying risk is real.

What Anthropic actually showed

Anthropic’s researchers did not demonstrate a fully autonomous rogue AI that can independently take over the internet. Instead, they tested whether a model could be distributed across devices with limited computing power and whether AI could coordinate the steps of self-replication in a controlled environment.

The first part of the experiment used Google’s Gemma 4, a 26-billion-parameter model, and split it across 15 Android smart TV boxes. None of those devices was powerful enough to run the model on its own, but together they could. That matters because it demonstrates a practical route for spreading AI workloads across ordinary household hardware rather than relying only on large data centers.

The second part simulated a network of machines designed to behave like Android devices. Within that setup, the researchers unleashed an AI-assisted worm — malware that can automatically copy itself from device to device — and asked it to search for new machines, move the model onto them and get the system running again.

Anthropic says the most capable model in the test, GLM-5.2 from the Chinese company Z.ai, was the only one that managed to spread across the entire simulated network. Smaller models were still able to complete some of the individual tasks, which is one reason the company says the risk is evolving quickly.

Why the warning is getting attention now

The concern around self-replicating systems is not new. AI safety researchers have warned for years that autonomous models could create problems that are hard to contain once they begin spreading through connected networks. What is different now is the combination of smaller, faster models and an internet full of vulnerable devices.

Frontier AI models are often so large that they are mostly confined to data centers, where companies can monitor usage and shut systems down if necessary. Smaller models, by contrast, are increasingly able to run on consumer-grade hardware, can be downloaded widely and are getting better at performing complex tasks with little human guidance.

That shift changes the threat model. If a model can run on a network of cheap devices — smart TVs, cameras, appliances, routers or other connected products — then the number of possible launch points grows dramatically. A worm does not need to target only the most valuable machines. It can also use poorly protected devices as stepping stones to reach something more important.

How close are we to a real AI worm?

We are not at a confirmed real-world outbreak, but the building blocks appear to be moving into place. Anthropic’s own researchers acknowledged that they have not demonstrated a complete “rogue replicator.” Still, they say the experiments reveal “signs of life” for AI worms and suggest that stronger device security is urgently needed.

That distinction matters. A proof of concept in a lab is not the same as malware loose in the wild. But in cybersecurity, demonstrations often matter because they show that an attack path is plausible, not merely theoretical. Once an approach becomes plausible, criminal groups are more likely to try to weaponize it.

Anthropic’s researchers said the work points to a future in which AI agents run on many kinds of hardware — including devices humans do not fully control — and argued that systems should be hardened now before such replicators become harder to stop.

What experts say about the risk

Cybersecurity specialists who reviewed the findings told The Verge that the alarm should be taken seriously, even if some of the language around AI doom can sound exaggerated. Their view is that the threat is concrete because smaller models are improving quickly and because the internet remains full of insecure connected hardware.

Jeffrey Ladish, executive director of the AI safety research group Palisade Research, said Anthropic’s contribution was to push the self-replication question further down the compute ladder. Palisade has already shown that AI systems can autonomously copy themselves onto other machines; what Anthropic adds is evidence that smaller models can do part of that work across low-powered devices.

Ladish also argued that this is not only a small-device problem. He expects larger frontier systems to eventually become able to run on extensive consumer-chip networks too, such as clusters built from MacBook-class hardware.

Nicolas Papernot, a University of Toronto professor who has studied AI-driven worms, said prior research had already made clear that such attacks were realistic. The new study, he said, expands the set of devices that can be used either as targets or as launchpads for other attacks.

Papernot warned that devices may no longer be worth attacking only for the data they contain; in the future, they may also be useful as stepping stones toward more valuable systems.

He also stressed that the biggest issue is not whether an AI can behave like a human villain. It is whether software can automatically chain together enough steps — discovery, copying, execution and persistence — to outpace human defenders.

How does an AI worm differ from ordinary malware?

An AI worm is more adaptable than traditional malware because it can make decisions during the attack rather than relying only on prewritten rules. That means it could potentially adjust to different devices, discover obstacles, rewrite tactics and continue searching until it finds a path forward.

Traditional worms already spread automatically, but AI could make them harder to block in at least three ways:

• They can evaluate different environments and choose the best next step.
• They can adapt their behavior when security tools interrupt a standard path.
• They can automate tasks that would otherwise require human operators to intervene.

That combination could turn ordinary household hardware into a distributed platform for cyberattacks. Smart appliances are often low-cost, lightly maintained and rarely updated as consistently as laptops or phones. Those conditions make them attractive if attackers want scale rather than precision.

Why smart devices are such attractive targets

Smart devices are a weak link because they are everywhere and often poorly secured. Many households now contain multiple internet-connected products that remain online for long periods, use default settings or receive infrequent software updates.

That gives attackers a large surface area to exploit. A compromised TV box or security camera may not be valuable on its own, but it can help an attacker build momentum. Once a worm can spread through many low-power devices, it may be able to use that infrastructure to probe more sensitive networks, mask malicious traffic or overwhelm defenses.

In practical terms, that means the internet’s most overlooked gadgets could become part of a much larger attack chain. What once seemed too insignificant to bother with could become useful simply because AI helps attackers scale their operations.

What kinds of devices are most exposed?

Any internet-connected device that is under-secured could be at risk, but the most obvious candidates include smart TVs, cameras, routers, home assistants, appliances and other consumer electronics. The more limited the security support and the slower the update cycle, the greater the danger.

Researchers are particularly worried about devices that are cheap, widely deployed and rarely monitored by owners. Those systems can linger for years in homes, offices and hospitals without much oversight, creating a broad target pool for future autonomous malware.

Timeline: how the AI worm debate has evolved

The idea of self-replicating digital systems has circulated for decades, but the combination of AI and consumer hardware has changed the urgency of the debate. The following timeline shows how the issue has developed.

Why the company’s motives are being questioned

Any warning from a major AI company is likely to draw skepticism, especially when it uses ominous language. Critics often accuse firms of amplifying fear to influence regulation, shape public opinion or highlight their own safety credentials.

That suspicion has surfaced again here. Some readers view the warning as another example of AI companies leaning into apocalyptic scenarios that are still far from reality. But the evidence in this case is not easy to dismiss, because it is grounded in testable security research rather than a vague thought experiment.

Anthropic also did not rely on its own models in the experiments, and the company has repeatedly argued that open models may create more risk than closed systems. That position is sure to remain controversial, but it does not negate the broader point that device-level security is weak and could become more important if AI tools keep improving.

How worried should regulators and security teams be?

They should be worried enough to act, but not so worried that they treat the threat as already inevitable. The best reading of the research is that the danger is emerging, not fully realized. That makes it a problem of preparedness.

For policymakers, the implication is that connected-device security is no longer just a consumer nuisance. If AI-driven worms become more capable, then the security of hospitals, power grids, industrial systems and even ordinary household devices becomes part of the same defensive perimeter.

For security teams, the practical response is familiar: stronger patching, tighter access controls, better isolation, improved authentication and more aggressive monitoring for unusual lateral movement. The new twist is that defenders may need to assume malware can reason through obstacles, not just follow a fixed playbook.

Papernot said critical infrastructure should be a priority, and Ladish warned that without a broad effort to secure devices of all kinds, the environment may be ideal for AI worms to spread. The phrase “fertile grounds” is apt: the modern internet contains a dense crop of connected hardware, much of it underprotected.

What happens next?

The next phase will likely be a race between model improvement and defensive hardening. If smaller models keep getting better at planning, executing tasks and operating across devices, the gap between lab demos and real-world attacks will narrow further. At the same time, if manufacturers and regulators improve device security, the opportunity for such attacks could be reduced.

Anthropic’s own forecast is blunt: the company says smaller models may reach the level of the best system in its test before the end of the year. If that happens, the question will stop being whether AI can contribute to self-replication and become how long defenders have before malicious actors attempt it at scale.

That is why the research has landed as more than just another AI safety headline. It sits at the intersection of consumer technology, cybersecurity and the practical limits of control over increasingly capable software. The warning is uncomfortable, but experts say the underlying message is straightforward: the threat may still be early, yet it is no longer abstract.

Key takeaways

• Anthropic says its research found early signs that AI could help create self-replicating malware.
• The company demonstrated that a model can be distributed across multiple low-powered devices.
• Security researchers say the risk is plausible because consumer devices are widespread and often poorly protected.
• The biggest concern is not a fully formed AI takeover, but automated malware that can spread and adapt.
• Experts say critical infrastructure and connected household devices need stronger security now.