Anthropic details threat of self-replicating AI worms on smart devices

Anthropic has outlined a new cybersecurity threat involving artificial intelligence programs that replicate autonomously across internet-connected devices. The company’s offensive research team, commonly referred to as a red team, reported creating a malicious AI program capable of spreading through smart televisions. The researchers noted that while machines running AI typically require significant computing power, their program distributed components across 15 televisions and maintained functionality by utilising limited processing capacity from each unit.

The report has raised concerns among security professionals due to the generally weak security architecture of smart televisions and other internet of things devices. Joshua Saxe, who led the development of Meta’s AI security efforts, described the threat as a significant cyber-attack vector requiring immediate mitigation. He expressed concern that the cybersecurity community is not treating these practical risks with sufficient seriousness. The analogy to fictional narratives, such as the division of a villain’s soul in the Harry Potter series, has been drawn to illustrate the resilience of the distributed program.

Self-replicating computer viruses, known as worms, have a history of causing substantial damage without requiring human interaction to propagate. Notable examples include the Morris worm of 1988, which exploited software flaws and weak passwords to slow down infected machines. More recent threats, such as Stuxnet, which targeted Iranian nuclear centrifuges, and the NotPetya and WannaCry worms, have caused tens of billions of dollars in global damage. Many of these destructive worms relied on unpatched vulnerabilities, a pattern the Anthropic team predicted could be replicated and exacerbated by AI-driven adaptation.

Ariel Herbert-Voss, an early security expert at OpenAI who now runs the AI security startup RunSybil, highlighted that AI models can learn and adapt as they progress, a capability that differentiates them from traditional reproducing viruses. He stated that existing cybersecurity infrastructure is ill-prepared for the potential proliferation of such threats and called for increased resources to support security teams. Chris Inglis, a former National Cyber Director, noted that the plausibility of AI worms has been demonstrated by recent events. He suggested that the focus should shift to how these tools are employed, countered, or combined with other emerging technologies.

Anthropic researchers indicated that a fully successful AI worm would require greater capability on less powerful devices than is currently possible. However, they projected that current technological trends will make this feasible by the end of the year. Their findings follow a paper published by the University of Toronto, which described a program that infected a full-size computer and spread to similar machines more rapidly than the television-based variant. Jonas Guan, a co-author of the Toronto paper, described the rapid development of these capabilities.

Despite the alarming nature of the reports, experts cautioned that AI worms should not be considered the primary AI threat. Guan noted that the Anthropic version moves slowly and exhibits predictable, detectable actions that can be blocked at multiple layers. Basic security measures, such as strong passwords and two-factor authentication, would prevent most such attacks. Juan Andres Guerrero-Saade, vice-president of research at SentinelOne, dismissed the threat as a stunt that amplifies sensationalist narratives, stating that the technology is neither truly feasible nor impactful at present.

The issue has broader implications for government oversight, with many in the AI and security sectors arguing that greater regulation is essential. Congressional efforts have produced conflicting bills, while the White House has established only a small review board. Observers continue to weigh the motivations behind security warnings from AI companies, ranging from genuine caution to strategic marketing. Gadi Evron, who is organising an AI security conference in San Francisco, acknowledged that while some claims may be marketing-driven, the underlying reality of AI risks remains significant and under-communicated.