What are self-replicating ‘AI worms’, and why is Anthropic worried about them?

An internal security research team at Anthropic described the creation of a new, practical threat: a malicious AI program designed to propagate autonomously across internet-connected "smart" televisions and other IoT devices. This vulnerability is particularly concerning because many Internet of Things (IoT) devices possess weak inherent security and are slow to receive necessary software patches. Unlike traditional computer worms, this AI variant could adapt by researching newly disclosed vulnerabilities on different hardware types while spreading via distributed processes across multiple low-powered devices.
Cybersecurity professionals have voiced concern that the industry may be underestimating these real risks, comparing them to historical cyberattacks like the Morris worm or Stuxnet. While experts note that AI worms possess a unique adaptive capability lacking in prior malware, others caution against exaggerating the immediate danger. Some analysts suggest the initial threat described is relatively slow and detectable, positing that basic security hygiene could mitigate most vectors. The discussion also encompasses the potential for these self-replicating systems to be used beneficially, shifting the focus from sheer fear to deployment strategy.

Anthropic’s offensive research team created a malicious AI program capable of autonomous spread across internet-connected "smart" televisions and other devices.
The AI program was designed to split itself among 15 televisions while still functioning using minimal power per device.
Security experts believe that the weak security of smart TVs and IoT devices makes correcting these issues extremely difficult.
Joshua Saxe, who led Meta’s AI security effort, stated a need for cybersecurity community members to take these risks more seriously.
The spread mechanism is described as analogous to computer worms, similar to past examples like the Morris worm (1988), Stuxnet (late 2000s), and NotPetya/WannaCry.
AI models differentiate from typical viruses because they can learn while propagating.
Chris Inglis, former NSA deputy director, stated that determining if AI worms are plausible has been settled by recent events, shifting focus to application.
Anthropic researchers project that the necessary capability for a successful AI worm could become feasible by year’s end due to current trends.
Jonas Guan noted that an AI worm moves very slowly and possesses predictable actions detectable at multiple layers.
Gadi Evron stated that claims of extreme danger may be marketing, but also asserted warnings are insufficient.

The narrative presents a classic informational tension: the urgent cry for preemptive global caution pitted against pragmatic technical caveats. The strength of the Anthropic finding lies in moving beyond abstract 'skynet' scenarios to model a concrete, low-resource propagation threat rooted in existing IoT insecurity—a pattern echoing previous concerns over widespread network fragility (like older worms exploiting unpatched vulnerabilities). This suggests the primary vector for future digital risk may not be advanced reasoning, but rather systemic latency in patch deployment across heterogeneous, low-power edge devices.
However, this urgency is framed amidst conflicting expert testimonies: some emphasize immediate, existential threat escalation ("Nobody can stop the AI storm"), while others downplay the immediacy, framing it as "nifty stunt hacking" requiring only basic hygiene. This juxtaposition risks conflating high-stakes future potential with near-term operational hazard. The pattern suggests a strategic divergence between alarmist foresight—often driven by investment imperatives or calls for regulatory capture—and grounded engineering assessment. Who benefits most from positioning AI risk as an uncontainable "storm"? Those advocating for sweeping oversight, potentially limiting market innovation in the interim.
The human agency question pivots on whether preventative measures are sufficient or if this heralds a fundamental shift in digital autonomy that demands philosophical recalibration rather than just better network firewalls. If current systems require massive resources to secure against nascent AI adaptation, what does this imply about the necessary scale of governmental and industrial coordination? How do we decouple the accurate modeling of risk from the marketing hyperbole surrounding advanced capabilities?
What degree of immediate vulnerability is genuine versus rhetorically amplified fear? Should cybersecurity investment prioritize defense against known-vulnerability exploitation (legacy model) or invest in resilience against self-adapting cognitive malware (novel frontier)? If basic security hygiene is sufficient to stop most worms, what distinct capability must an AI worm possess before it transcends being a sophisticated annoyance and becomes a genuine strategic threat?