Artificial intelligence models could eventually be able to copy themselves on everyday internet-connected devices like smart TVs, ovens and other home appliances. Anthropic has warned that this could create new cybersecurity problems as AI systems become more powerful.
The concern is that self-replicating AI systems may be able to move between vulnerable devices with little human intervention. Such systems could look like computer worms spreading by exploiting the weaknesses in connected machines.
According to the study, smaller AI models could eventually be able to run across inexpensive Internet of Things (IoT) devices. But the prospect of such attacks should not be confused with evidence that autonomous AI worms are already spreading through household appliances.
How could self-replicating AI work?
Self-replicating AI refers to an AI system that can copy and deploy itself onto other machines without the need for human input.
The process may look like a computer worm. Such malware spreads from one vulnerable system to another and can spread to many devices connected to the same network.
An AI-powered version may be able to use its reasoning and problem-solving skills to adapt to different devices and try different approaches if it encounters technical obstacles.
For this to happen, a system would need to be able to identify potential targets, gain access to vulnerable devices, deploy its model and keep spreading.
While AI systems can perform some of these individual tasks, it is a technical challenge to combine them into a reliable, autonomous replication process.
Why smart TVs and ovens would be some of the targets.
Connected devices may have security weaknesses.
Smart TVs, connected kitchen appliances, robotic vacuum cleaners and other IoT products have computing capabilities and internet connections.
But even then some devices are not updated very often and keep using the same firmware. Other devices may use weak default passwords and unnecessary remote-access features.
These security weaknesses can be exploited by cybercriminals to make poorly secured devices valuable.
If self-replicating AI becomes possible, vulnerable connected appliances can even become additional hosts for malicious software. The actual risk would depend on the device hardware, software, security protections and network configuration.
The threat goes beyond televisions and ovens. Connected cameras, refrigerators, smart speakers and other internet-enabled products could also face risks if their security weaknesses were exploited.
Small devices could provide computing power.
Many household devices have limited memory and processing power. This makes it difficult to run large AI models on a single device.
However, researchers have shown some AI models can be distributed among several machines. Each machine handles a part of the model, and the connected devices work together.
Anthropic’s work included an experiment with the Gemma4-26B-A4B model running on 15 inexpensive Android TV boxes.
The experiment revealed how relatively inexpensive hardware could help run a larger AI model.
But spreading an AI model across devices is not the same as infecting those devices. And such a demonstration does not, by itself, prove that an AI system can independently discover vulnerabilities, compromise appliances and replicate across real-world networks.
What Anthropic’s research shows about AI risks
The research studied how AI models can complete different stages of the autonomous replication process.
Some models showed capabilities that might be useful for AI systems running on different hardware configurations, the report said. The researchers also studied whether models could complete a set of steps related to replication under controlled conditions.
However, the evaluation had many limitations. The initial access stage was simplified so the results do not indicate that the model could independently find and exploit vulnerabilities in arbitrary consumer devices.
The research also revealed that replication with low-powered IoT hardware could be slow. For the scenarios discussed, the process could take days to take place rather than instantaneously.
These limitations make it important to assess the findings. If a model shows parts of a technical process under controlled conditions, it doesn’t mean that the whole process can be carried out independently in the real world.
Why AI worms could be difficult to contain.
Traditional malware already spreads through vulnerable computers and connected devices. There may be more problems if AI-powered malware could adapt to different systems.
An autonomous system could try new approaches if one of the methods fails. It could also potentially vary its deployment process based on the hardware or software it encounters.
Distribution is another issue. If malicious software is running on many compromised devices at once, it is not enough to shut down one central server to prevent every copy.
Such security teams would need to find affected devices, remove malicious software and prevent further communication between compromised systems.
But the severity of such a threat would depend on the AI system's capabilities, the number of vulnerable devices, the available computing resources, and the effectiveness of existing security measures.
A network of inexpensive appliances would not automatically have the same processing power or capabilities as a modern data center.
How can one protect the smart home products?
While self-replicating AI is still a developing security issue, there are ways to reduce the risk of typical cyberattacks against connected appliances.
Keep software updated
Install firmware and security updates from device makers. Updates can fix vulnerabilities that attackers might otherwise exploit.
Change default passwords
Replace default passwords with strong and unique credentials. Don’t use the same password for multiple devices and accounts.
Disable unnecessary remote access
Turn off remote access features and services that are not needed. This can reduce the number of possible methods an attacker might try to access a device.
Have a separate network for smart devices.
Smart home appliances should be connected to a separate network from computers and other sensitive devices if they are supported. A compromised device could reduce access between devices.
Choose devices with reliable security support.
Before buying connected appliances, check if the manufacturer provides regular security updates and clearly communicates its software support policy.
These measures will not eliminate every risk but they may reduce exposure to common device vulnerabilities.
AI safety and IoT security are increasingly connected.
The warning is emblematic of the more general challenge of technology companies. As AI models grow, researchers and security experts will need to consider how they might interact with widely distributed computing devices.
Internet-connected appliances provide convenience, but their security depends on manufacturers, software developers, network operators and users.
The question is whether the increasingly powerful AI systems will merge existing technical capabilities with automated processes that are more difficult to detect and contain. At the moment, self-replicating AI spreading across household appliances should be seen as a potential cybersecurity threat, not as evidence that smart TVs and ovens are already being infected by autonomous AI worms.
Comments