Artificial intelligence-powered malware capable of copying itself and spreading across internet-connected devices could become a major cybersecurity threat in the near future, according to new research by AI company Anthropic.

The study, published on 12 October, warns that low-cost smart devices connected to the internet—including smart televisions, robot vacuum cleaners, security cameras and other household appliances—could eventually be exploited by self-replicating AI-powered worms.

Researchers said such malware could move from one compromised device to another, run its own AI model and continue spreading without direct human intervention. Devices with weak security protections are considered particularly vulnerable to this type of attack.

Researchers test AI on Android TV devices

As part of the study, Anthropic researchers successfully deployed an AI model on 15 low-cost Android TV devices and examined its ability to complete the steps required to replicate itself across a simplified test network.

The company stressed, however, that the experiments did not demonstrate a fully autonomous AI worm spreading across real-world smart home devices. Instead, the research assessed whether current AI models possess the capabilities that could eventually enable such behaviour.

According to the findings, some AI models with 30 billion parameters or fewer can already perform a significant portion of the tasks required for self-replication.

Anthropic said that if current development trends continue, smaller AI models could become capable of completing the entire self-replication process by the end of the year.

Difficult to stop once distributed

Unlike conventional malware, AI-powered worms could potentially adapt to different hardware and software environments, learn how to operate on newly infected systems and continue spreading without continuous human control.

Researchers warned that if such malware were distributed across large numbers of internet-connected devices, disabling it from a single central point could become far more difficult, complicating detection and containment efforts.

Experts divided over the level of risk

Cybersecurity experts remain divided over how imminent the threat is.

Some researchers view autonomous AI replication as a significant long-term cybersecurity risk, while others argue that the current experiments do not justify expectations of an immediate large-scale security crisis.

Jessica Ji, a researcher at Georgetown University's Center for Security and Emerging Technology, said such a scenario cannot be ruled out but noted that the likelihood of it occurring remains uncertain.

Anthropic emphasized that the best defence against potential AI-powered malware remains strengthening cybersecurity practices, promptly patching software vulnerabilities and improving protections for internet-connected devices.

The researchers stressed that self-replicating AI systems should currently be regarded as a potential future cybersecurity risk rather than an established real-world threat, while calling for continued monitoring as AI capabilities continue to advance.(ILKHA)