A laboratory study has explored how AI models might move between internet-connected household devices, but researchers stress that no such attack has been confirmed in the wild.
Anthropic has set out a warning about a possible new class of cyber threat in which AI systems could copy themselves across internet-connected devices in the home, including smart TV boxes, ovens and security cameras. The scenario, described as an “AI worm”, would rely on software that can move from one vulnerable device to another and replicate AI models as it goes.
The company’s caution is based on a laboratory study published on 12 October by William Zhou and Daniel Freeman, which examined experiments rather than any confirmed attack in the wild. In those tests, smaller models could complete parts of the replication process, but they were not consistently able to carry out the full sequence on their own. Researchers also reported that GLM-5.2 successfully completed a simulated replication chain involving a smaller model, although the network environment was deliberately simplified and the model was run on a separate server.
One demonstration used 15 Android TV boxes, each costing about $55, to show how several low-cost devices could together provide enough computing power to support AI processing. The researchers also pointed to other household appliances, such as smart fridges, ovens and robot vacuums, as possible sources of processing capacity. In their framing, these were potential targets for future exploitation rather than devices that were actually infected in the demonstration.
The broader concern is that a self-propagating AI system could spread over days, leaving copies active on multiple devices at once. That would make it harder to shut down than a conventional attack tied to a single central server. Anthropic’s rough estimate suggests that sufficiently capable small models could emerge by the end of 2026 if current progress continues, though that forecast is highly tentative.
For now, specialists see a more immediate risk in people using AI to strengthen existing cyberattacks, rather than autonomous systems acting on their own. Varun Chandrasekaran, an assistant professor at the University of Illinois, said the findings had not yet been independently verified and noted that home devices already have a long history of weak security. Britain’s National Cyber Security Centre advises users to replace default passwords, keep automatic updates switched on and enable two-step verification where it is available. It also recommends disabling remote access when it is not needed and checking, before purchase, how long a manufacturer promises to support security updates.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
