A security camera, a smart oven and a cheap television box are unlikely candidates for science-fiction villains. Yet researchers at Anthropic say ordinary connected gadgets could eventually provide the computing power and vulnerabilities needed for self-replicating AI malware. Their research, published on 12 October 2026, explores how AI worms might identify devices, get software running and copy themselves to further machines without constant human direction. It is a warning about emerging technical feasibility, not a report of an autonomous AI infection spreading through people’s kitchens today. Anthropic's primary research is explicit about the steps it managed to test and the steps that remain out of reach.
The distinguishing fear is adaptability. Traditional malicious software often arrives with instructions written for particular targets. A sufficiently capable AI agent might encounter unfamiliar hardware, investigate its operating system and work out how to deploy itself. That could make a future worm less dependent on a criminal manually preparing a different version for each device. The immediate lesson is still a familiar one: internet-connected products need sound security even when they seem too mundane to interest an attacker.
AI worms need more than clever language
For a worm to exist in the worrying form described, several things must work together. It must discover a suitable target, gain access, install or launch the components required to run its model, and then repeat the process. Carrying a model around is different from relying on an outside AI service. A smaller model might fit on modest hardware, while a larger one can require devices to cooperate across a network. Each possibility introduces substantial technical and logistical obstacles.
Anthropic’s team tested whether smaller models could establish the software they needed across different machines. One nine-billion-parameter model succeeded on eight of nine hardware types in that part of the assessment. But that does not mean the same model autonomously found, compromised and replicated itself across those machines in real conditions. A more capable system completed end-to-end tasks in simplified experiments that removed some real-world barriers. Models of a suitable size still struggled to combine the necessary actions reliably.
A company research project also has boundaries. Laboratory test environments are selected and instrumented so researchers can examine particular abilities. Real homes contain different networks, login protections, updates and hardware limitations. The results tell us that parts of a potential attack chain are becoming technically possible, not how frequently ordinary customers are about to encounter it. Anthropic’s suggestion that capabilities could improve within months is a projection, not a confirmed deployment timetable.
Why the weakest device can matter to the whole home
A connected appliance may be attractive to criminals because it is easy to overlook. A phone or laptop often receives conspicuous security updates. An inexpensive smart plug, baby monitor or streaming box might be left running long after its owner has forgotten the manufacturer’s name. An intruder who controls a device may be able to use it as a foothold on a network or to assist further attacks, depending on its privileges and connectivity.
The scenario does not require every smart oven to become independently intelligent. An attacker could favour devices that have exposed management interfaces, weak credentials or outdated software. Models that can adapt across hardware would make those basic weaknesses more valuable to exploit. Anthropic’s discussion is careful to separate this specific threat from other forms of AI-enabled intrusion, including attacks that depend on stolen access to paid cloud services.
The UK National Cyber Security Centre's smart-device guidance makes the consumer response concrete. British product-security rules require manufacturers of covered consumer smart devices to avoid easily discoverable default passwords, provide a route for vulnerability reporting and state the minimum period of security updates. Owners should still check settings, use strong credentials, enable two-step verification where available and apply updates. These are protections against existing criminals too, not emergency measures invented for a theoretical AI worm.
No single off-switch would make defence more complicated
A conventional online service can sometimes be disabled by withdrawing access to the central infrastructure that powers it. A worm carrying a working model across independent devices would not necessarily have that central point of control. Removing it might require finding infected devices, blocking communications, notifying owners and repairing weaknesses across different networks. In practice, investigators could still identify unusual traffic, and defenders would have opportunities to contain it.
Anthropic discusses signatures that a large model transfer or intensive device-to-device communication might leave behind. That is a reminder that adaptability does not equal invisibility. A malicious program that transfers sizeable files, scans nearby systems or consumes unusual computing resources could attract attention. How quickly it spreads, what resources it uses and whether it can remain persistent are all part of its viability, not footnotes to an inevitable outcome.
This scenario sits alongside wider concerns over autonomous AI agents in cyber incidents and the question of using advanced models in defensive security. It should not be confused with any particular attack covered in those earlier reports. The important new evidence here is a set of technical experiments directed at self-deployment on modest hardware, accompanied by cautious projections about what improved models might one day assemble.
For homeowners, the useful response is decidedly uncinematic: make an inventory of connected products, replace unsupported devices, update software and secure the accounts that manage them. Anthropic has raised a serious research question. Turning a laboratory warning into an assertion that your fridge has already joined an AI botnet would go well beyond the evidence.
About the Author
Stuart Kerr is Technology Correspondent at LiveAIWire, covering artificial intelligence, cybersecurity and the social impact of emerging technology. LiveAIWire is an independent, human-led technology publication using AI-assisted research, editorial production and original AI-assisted editorial illustrations under his direction.