Quick Summary
- AI worms are programs that use an AI model to copy themselves from one device to another without human help.
- Anthropic researchers ran a Google Gemma model across 15 inexpensive Android TV boxes to show that cheap hardware can host an AI model.
- The team warns that small AI models may be months away from spreading across devices such as smart ovens and off-brand TV boxes.
- The tests were simplified. No small model has been shown to spread on its own across real household devices.
- An outside expert says the findings match other research but have not been independently verified.
- Criminals already abuse connected devices, as the Mirai and BADBOX 2.0 botnets show.
- Updates, trusted brands, careful app choices, and a separate network for smart devices lower the risk.
A Cheap TV Box Experiment
Anthropic’s Frontier Red Team built a test setup from off-brand Android TV boxes. Each box cost about 55 dollars and held 4 gigabytes of memory. The team networked 15 of them and ran a Google Gemma model across the group. Each box carried a small slice of the model because none could hold all of it.
The setup was slow, producing less than half a token of text per second. A token is roughly a short word or a piece of one. The speed was not the point of the demonstration. Cheap and poorly protected hardware can supply enough computing power to run a capable model.
Based on Anthropic’s research, the team warns that small AI models may soon be able to spread across devices like smart ovens and TV boxes. They describe the gap as a matter of months. In this scenario AI is not just helping an attacker write malicious code. It becomes part of the software that does the copying.
How AI Worms Would Copy Themselves
Anthropic breaks the process into four stages. The researchers wanted to know whether AI agents could finish the whole sequence. The stages are listed below.
- Find another device on the network.
- Gain the ability to run code on that device.
- Set up the software needed to run an AI model.
- Continue spreading from the new host.
The first two stages are standard hacking steps. Earlier studies had already shown that small models can handle many cyber tasks. Anthropic therefore focused on the third stage, which is harder than it sounds. A model has to pick compatible software, find the right versions, and fix problems that are specific to each machine.
The results were mixed. A small model with 9 billion parameters got an AI model running on eight of the nine hardware types tested. In a separate test the researchers built a sealed network of eight emulated Android devices in Google’s cloud. The strongest model in that test spread to all eight devices in four of five trials and to seven in the fifth.
What the Tests Did and Did Not Prove
The researchers did not show a small model spreading and running on its own across compromised household devices. The tests used Android emulators with debugging access left open and no login required. That setup makes it much easier to break in than it would be on a properly secured device.
Real-world conditions could slow a worm down. Moving large files and keeping up steady traffic between devices would make it easier to detect. Anthropic notes that this kind of activity could leave a visible signature on a network. Limited computing power would also hold back its speed.
The biggest gap is capability. No tested model was both strong enough to complete the replication process and small enough to run on the consumer hardware being targeted. Anthropic describes a skill floor that a worm must clear and a size ceiling that it must stay under. Right now those two limits do not overlap.
A Rough Timeline Through 2026
Anthropic projects that smaller models could reach the needed skill level by the end of 2026. That projection assumes they keep improving at their historical rate. The company calls it a rough estimate, because it relies on a general capability score that only approximates replication skill.
The team also expects any spread of this kind to be slow. It estimates a doubling time of days, not minutes. The researchers compare the likely pace to a swarm of fruit flies.
An Outside Expert Urges Caution
Varun Chandrasekaran is an assistant professor at the University of Illinois. He spoke to the news agency AFP about the research. He said the findings were consistent with related work. He also cautioned that Anthropic’s results had not been independently verified.
In his view the bigger current threat comes from people using AI to improve their attacks. He did not point to AI systems going rogue as the main danger today. This context matters for readers. The warning describes a plausible path, not a confirmed event.
Hijacked Gadgets Are Already a Problem
Criminals taking over connected devices is nothing new. The Mirai botnet infected mostly embedded and internet-connected devices such as cameras and routers. A USENIX security study found that it reached about 600,000 infections at its peak. Those devices were used in denial-of-service attacks, which flood a service with traffic until it stops working.
BADBOX 2.0 shows a different kind of abuse. An FBI public service announcement says the botnet includes millions of infected devices, such as streaming boxes and digital picture frames. Some arrive infected, while others are infected through apps from unofficial marketplaces. Criminals use the devices for residential proxy services, which route other people’s traffic through a victim’s home internet connection.
Neither botnet involves an AI that copies itself. Both show that everyday gadgets can serve as infrastructure for criminals.
Simple Habits That Protect Your Home Network
The practical response is to give any attacker fewer openings. The steps below help against traditional botnets and would also reduce exposure to a future AI worm.
- Keep everything up to date. Update operating systems, apps, and firmware. Updates close known security holes that attackers rely on. Smart TVs, streaming boxes, and routers all need this attention.
- Buy from reputable vendors. Choose brands that provide ongoing firmware and security updates. A bargain device is less appealing if its software cannot be trusted or patched. The FBI also lists unrecognizable brands as a possible warning sign.
- Skip unofficial app stores. Avoid marketplaces that promise free streaming content. The FBI flags these stores in its BADBOX 2.0 guidance.
- Leave your protections on. Do not turn off security settings just to make an app work. A request to disable Google Play Protect is a warning sign, as is an Android device that lacks Play Protect certification.
- Disconnect anything suspicious. If a device looks off, take it off your network while you investigate.
- Give smart devices their own network. Put devices that cannot run security software on a separate network, such as a guest network. That keeps them apart from your computers and phones.
Should You Be Worried Right Now?
The research describes a possibility, not a present danger. Small AI models have not yet been shown to spread by themselves across real devices. Researchers still consider the trend worth watching.
Households can act without waiting for a final answer. Updated software, trusted brands, careful app choices, and a separate network make life harder for any attacker. Those habits already guard against threats that exist today.
AI worms remain a developing story. The next step is independent verification of Anthropic’s findings. Until then, steady and sensible device habits are the best response.
Discover how AI is reshaping technology, business, and healthcare—without the hype.
Visit InfluenceOfAI.com for easy-to-understand insights, expert analysis, and real-world applications of artificial intelligence. From the latest tools to emerging trends, we help you navigate the AI landscape with clarity and confidence
