New research from AI company Anthropic warns that small AI models may be just months away from being able to copy themselves across cheap, poorly secured internet-connected gadgets, like off-brand streaming boxes, smart cameras and appliances. Because that kind of worm would live across thousands or even millions of devices rather than inside a single data center, the company says there would be no central place to shut it off.
The report, published Monday by Anthropic's Frontier Red Team, a group that tests AI models for dangerous capabilities, comes as the industry faces growing scrutiny over AI agents breaking out of their testing environments. It also lands two weeks after top AI executives, including Anthropic CEO Dario Amodei, signed a voluntary White House pledge to police themselves.
To show that everyday gadgets have enough computing power to host an AI model, Anthropic researchers bought 15 off-brand Android TV boxes for about $55 each and networked them together. They then ran an AI model across all 15, with each box handling a small slice of the work. It ran slowly, at well under one word per second, but it ran.
RELATED STORY | Millions back demand for human control of AI as safety debate intensifies
Next, the team tested whether small AI models could get themselves running on unfamiliar hardware without human help. One model with 9 billion parameters, small by today's standards, managed it on eight of the nine types of hardware tested, which ranged from tiny developer boards to Mac computers.
Finally, researchers built a sealed-off network of eight simulated Android devices in Google's cloud and dropped an AI worm onto one of them. Only one model, GLM-5.2, reliably completed the full cycle of finding a new device, copying itself over, getting up and running and repeating the process. It reached all eight machines in four of five trials.
The researchers acknowledge they made the hacking step easy by leaving the devices without password protection, so the results represent a best-case scenario for the worm. Anthropic estimates that small models could reach GLM-5.2's level by the end of 2026. Any resulting worm would likely spread slowly, with infections doubling over days rather than minutes. But in one test, AI copies that inherited notes from earlier attempts got better over time, with success rates climbing from 45% in the first generation to as high as 84% in later ones.
The company stresses it has not yet seen a full rogue replicator. Still, it points to a real-world precedent: a botnet called Kimwolf that infected more than 2 million devices, mostly off-brand Android TV boxes. Those boxes typically run stripped-down versions of Android that manufacturers don't add security features to.
RELATED STORY | Top AI companies have discussed creating their own standards body
Bruce Schneier, a cybersecurity expert and author who teaches at the Harvard Kennedy School and the University of Toronto's Munk School, says the problem starts with how these devices are built.
"Your phone, your computer, they're as secure as they are for two reasons. One, there's a dedicated team of engineers at Apple, Google, Microsoft designing them to be secure in the first place, and those same engineers are around to write patches when new vulnerabilities are discovered," Schneier told Scripps News. "[Internet-of-things, or IoT] devices are made much more cheaply.”
Many of these devices can't be fixed at all once a flaw is found, he said. "There's no way for you to patch, for example, your home router. The way you patch it is you throw it away and buy a new one."
Schneier says hackers hijacking these gadgets is nothing new. "We're already seeing hackers get into interconnected refrigerators and appliances to mine Bitcoin, to steal credentials," he said. What AI changes is the pace. "It's not a new risk with AI. It's not a scarier risk, it's just there, but AI can do it at unprecedented speed and scale."
Anthropic's suggested defenses lean largely on others. The company says Internet providers could spot the unusual traffic an AI worm would create, like multi-gigabyte downloads landing on streaming boxes. Device makers could ship more secure defaults, as the United Kingdom now requires by banning default passwords.
But the company also concludes that society should harden its systems while preparing "to deal with a world where they are here to stay."
Schneier rejects the idea that a runaway AI can't be stopped.
"Of course it's possible to have a kill switch. It's possible to turn computers off. It's possible to turn companies off, right? It's a measure of these companies' power that they'll say it went rogue, it's not our fault, which is of course nonsense," he told Scripps News. "There's nothing magic about this. It's a piece of equipment. It runs on electricity. Turn the power off and it goes away."
He argues that placing the burden on device makers and internet providers lets AI developers off the hook. "The AI companies are responsible when it's good, but not responsible when it's bad," Schneier said. "We could choose to fix this, of course. We could have liabilities like any other product."
For people worried about the gadgets already in their homes, Schneier offers little comfort. Without strong product liability laws or aggressive federal enforcement, he says, shoppers have few ways to know which devices are safe.
"There's nothing you can do, right? You have no visibility into whether these devices are good or not," he said.
Basic steps can still reduce exposure, such as changing default passwords and installing updates when devices offer them, or upgrading to a more expensive brand-name device.
