AI Worms: Anthropic Warns of IoT Risk
Anthropic says AI worms could soon spread across insecure connected devices. Learn what the warning means, where the risks lie, and how to prepare.
AI Worms Could Target Connected Devices. What Anthropic's Warning Means
If a smart TV or camera gets hacked, that's already a real problem. The scarier scenario is when one compromised device becomes a starting point for finding and infecting others - often with minimal effort from the attacker once the first foothold is in place. That's what Anthropic is warning about with the idea of potential self-replicating "AI worms."
In a report from its Frontier Red Team, researchers William Zhou and Daniel Freeman argue that smaller AI models may be months away from being capable enough to self-replicate on commercial Internet of Things (IoT) devices. They point to examples like Android TVs, cameras, and other connected products that tend to have limited computing power and weaker security. They also call out a practical hurdle: if the infection is distributed across many devices, there may be no single "switch" that can shut it down.
This is a warning about possible near-term capabilities - not proof that an AI worm is already spreading through household devices. The distinction matters. For security teams and businesses, the key question is whether AI makes it easier to discover, adapt to, and exploit weaknesses at scale. Here's what the warning is saying, what risk factors are most likely to matter, and what device makers and operators can do now.
What Anthropic's AI worm warning says
At the center of Anthropic's warning isn't the idea that an AI model has escaped control and is actively infecting home devices. Instead, it's the possibility that AI systems could soon support a chain of actions that would make self-propagating malware easier to build or run.
A traditional computer worm spreads between systems without needing someone to manually install it on every target. An "AI worm" would be a variant where AI helps with parts of that process - for example, by assisting with identifying weaknesses, interpreting what it sees in a device's environment, or adapting behavior across different systems. The term doesn't require the AI to independently choose goals, and it doesn't imply that the model itself gets copied onto every infected device.
That clarification is important because the phrase "AI worm" can sound more autonomous than the real technology actually supports. Automation can still make attacks cheaper and faster - even if there are human operators in the loop, pre-set tools being used, or narrow conditions that trigger actions. The real security question isn't "does it have intent like a person?" It's whether automation makes attacks easier to repeat and scale.
Why IoT devices are a plausible concern
Many connected devices are built under tight constraints - cost, performance, and battery or power usage. A smart camera or television may not get the same security scrutiny as a laptop or phone, even though it's online for years. Depending on the product, it may also have limited update support, weak default settings, or components that are hard for owners to inspect.
None of that is unique to AI. It's the familiar IoT security problem. AI becomes relevant if it helps an attacker move through variation faster - differences across device models, software versions, or configurations. But the underlying exposure still depends on whether devices are poorly maintained or easy to reach.
Anthropic's researchers describe small models as "months away" from being capable enough to self-replicate on commercial IoT devices. That's a forecast, not evidence that a working, widely usable AI worm is already operating. Treating the warning as proof of an imminent outbreak overstates what we know. Dismissing it because there's no confirmed incident misses the point of acting early and testing assumptions.
The warning is summarized in Cointelegraph's report on Anthropic's AI worm research. For security leaders, the useful response is to turn the forecast into concrete questions: Which devices can be reached? Who patches them? What happens if an account or device is compromised? How quickly can the organization spot unusual traffic?
How an AI worm could spread across IoT devices
Self-propagating malware depends on a chain of conditions. AI might change the cost or adaptability of some steps, but it doesn't remove the need for an actual path into devices - and then onward to other targets.
In broad terms, an attack could look like this: find exposed or poorly protected devices, exploit a weakness, then move from one system to another. AI could help with recognizing patterns, handling differences between devices, or automating parts of the workflow. But those are general risk scenarios, not proof that Anthropic has shown a specific attack path against particular products.
The practical takeaway is that "AI-powered" doesn't mean "magically capable." A model can't compromise a device if there's no exploitable route available. Things like network access, vulnerable software, weak credentials, and monitoring still decide whether an attack works.
Why "no central off switch" matters
In a centrally managed environment, an operator can often disable features, isolate a server, or take other coordinated steps quickly. A worm spread across many devices is different. If devices communicate directly (or through multiple independent networks), it may be hard to stop every infected unit at once from a single place.
That doesn't mean containment is impossible. It means response becomes a coordination problem. Device owners, internet service providers, cloud providers, manufacturers, and security teams may each have only partial control. Some devices might be offline during remediation. Others might not receive updates anymore. Even if a patch is deployed, it might not clean up a system that was already compromised.
This is where basic engineering choices show up in real-world operations. Products that can receive signed updates, report software versions, and be isolated remotely are easier to manage than devices that can't be touched after sale. Those capabilities don't guarantee safety, but they give responders more options than products that essentially disappear once they're in the field.
Capability, access, and impact are separate questions
A lot of security talk goes off the rails when it mixes up three different questions:
- Capability: Can an AI system help automate or adapt parts of an attack?
- Access: Are there reachable devices with weaknesses that make compromise possible?
- Impact: What could an attacker do after gaining access, and how far could it spread?
An affirmative answer to capability doesn't automatically answer access and impact. A model might be able to assist with a task, but real-world exploitation is still limited by reach, device diversity, and the cost of operating at scale. On the other hand, even a modest capability can still create serious risk if many devices share the same fixable weakness.
If you're evaluating emerging AI threats, this framing is more useful than asking whether an AI system is "dangerous" in the abstract. Map the attack surface, test likely failure paths, and estimate what happens if controls fail. That turns speculation into decisions security and product teams can act on.
What the threat means for businesses and consumers
For businesses, IoT exposure often looks like an asset-management problem first, and an AI problem second. Devices get installed by contractors, added by employees, and embedded in offices, warehouses, retail locations, and industrial settings. If nobody owns the inventory, it's difficult to know what needs patching - or which network activity is actually unusual.
Consumer environments have similar challenges, just with different options. Households may have televisions, doorbells, cameras, speakers, and appliances from multiple manufacturers. Owners can't always inspect software or decide when updates stop arriving. That means the vendor's support policy becomes part of the security model, not just a customer-service detail.
The business risks are operational, not just technical
A compromised device can be used in ways that cause disruption or costs, depending on what the attacker wants and what the device can reach. Possible consequences include service interruptions, compromised accounts, privacy breaches, or devices being used as part of a broader malicious network. But the exact outcome depends on the product and its connectivity - so you shouldn't assume every hacked smart appliance can access a company's sensitive systems.
The more immediate management issue is uncertainty. If a business can't answer which devices are connected, which ones are still supported, and who has the authority to isolate them, incident response may start with basic discovery rather than containment.
That uncertainty also affects procurement and product strategy. A low-cost device can turn into a long-term liability if there's no clear update commitment, weak identity controls, or no practical way to disable access after a breach. The purchase price is only one piece of the total cost. The ongoing work of maintaining - and eventually retiring - the device matters just as much.
Keep the cryptocurrency risk separate
This report appeared during broader discussion about whether advances in AI could eventually affect cryptography used by cryptocurrency wallets. The source article also raises concerns about Bitcoin addresses and the elliptic curve digital signature algorithm (ECDSA), along with disagreement about how urgent and effective address updates would be.
That's a different risk category from IoT malware. A worm is about software compromise and network exposure. Attacking cryptographic signatures is about whether an attacker can derive or forge information protected by cryptography. Both deserve careful evaluation, but they have different mechanisms, timelines, and fixes.
Mixing them up can lead to bad decisions - either treating every AI-related security concern as one looming crisis or dismissing unrelated warnings because something else isn't confirmed. The better approach is to assess each threat on its own evidence and threat model. The Cointelegraph report links to related discussion of AI and crypto security, but that broader debate doesn't mean an IoT worm can break wallet cryptography.
How to reduce the risk without waiting for a crisis
There isn't a single control that makes connected devices safe. In practice, resilience comes from reducing exposure, limiting what a compromised device can reach, and making sure someone can respond quickly when a device behaves oddly. Organizations don't need to predict exactly what future AI systems can do before improving these fundamentals.
For device makers and product teams
Security has to be built into the product lifecycle, not treated as an after-launch support chore. Manufacturers should be able to explain how devices receive updates, how long updates are supported, and what happens once a vulnerability is found. If a product can't be maintained securely for a reasonable time, that should be addressed before deployment - not buried in fine print.
Practical priorities include:
- Use unique credentials instead of shared default passwords.
- Minimize exposed services and disable features that aren't needed.
- Provide authenticated, integrity-checked software updates.
- Make update status and support end dates clear to buyers and administrators.
- Let operators revoke access, isolate devices, or restore them to a known safe state.
- Test across realistic network setups, not just a controlled lab.
These steps don't prevent compromise in every case. They reduce the number of easy paths into devices and improve the odds that vulnerabilities get fixed before they turn into an operational emergency.
For businesses operating connected devices
Start with an inventory. Document what's connected, where it is, who owns it, what network it uses, and whether the manufacturer still supports it. Even an incomplete inventory beats assuming your network only contains approved devices.
Then apply controls based on the device's role:
- Segment devices. Keep consumer-grade or low-trust equipment away from business-critical systems where possible.
- Reduce unnecessary access. Restrict inbound and outbound connections to what the device needs.
- Track support status. Replace or isolate devices that can't receive security updates and don't have solid compensating controls.
- Monitor behavior. Watch for unexpected destinations, odd traffic patterns, or changes in device activity.
- Define response ownership. Decide who can disconnect a device, contact the vendor, and approve restoration.
- Exercise the plan. A written incident process is only useful if the people responsible can actually run it under pressure.
There's a real trade-off here. Segmentation and monitoring take time, and strict controls can break poorly designed products. That's not a reason to skip them - it's a reason to test them ahead of time and include IT, operations, and product owners in the decision.
For consumers
Consumers have less control over device software, but a few choices can cut down avoidable exposure. Change default passwords when possible, install available updates, use a separate guest or IoT network if your router supports it, and remove devices you no longer use. Before buying, check whether the manufacturer publishes an update policy and a support period.
If a device is unsupported and can't be safely isolated, replacing it may be the most sensible option. That's not always cheap or convenient, which is exactly why long-term support commitments from manufacturers matter. Security shouldn't depend on owners guessing whether a device will still get fixes years after purchase.
Conclusion
Anthropic's warning is best seen as a planning signal, not a report of an ongoing AI-driven epidemic. AI could make certain cyber operations more adaptable or easier to automate, but the practical impact still depends on vulnerable devices, network access, and the quality of security operations.
For businesses, the work is familiar: know what's connected, reduce unnecessary access, keep devices supported, and make isolation possible. For product teams, updateability and clear support commitments should be treated as core design requirements. For consumers, basic device hygiene helps, but manufacturers also carry responsibility when products stay online for years.
Don't wait for a precise prediction about when AI worms will arrive. Review your connected-device inventory and your incident plan now. That work improves resilience against both AI-assisted attacks and the ordinary security failures organizations deal with every day.