The difficult part is the hardware
A computer worm spreads by itself, without persuading a user to open a file or click a link. Past worms have caused some of the largest disruptions in internet history.
Many destructive worms have relied on known vulnerabilities that device owners failed to patch, sometimes for months after updates became available. Anthropic’s researchers say an AI worm could exploit the same gap, while adapting to different kinds of equipment by learning about newly discovered vulnerabilities.
The harder problem is keeping ordinary connected devices secure. Smart TVs and other internet-of-things hardware are updated less often than phones and laptops, according to the report. In Anthropic’s test, the program distributed its components across 15 TVs, drawing a small amount of computing power from each.
That makes the demonstration less about a suddenly powerful machine than about a familiar weakness: a large population of devices that is difficult to maintain.
A demonstration, not a forecast
The researchers say an effective AI worm would need broader capabilities on less powerful devices than models have today. They believe current trends could make that feasible by the end of the year. A few months earlier, researchers at the University of Toronto reported infecting a regular computer with a worm that could spread to similar machines faster than the TV program. Co-author Jonas Guan, a University of Toronto graduate student, said the capabilities of these systems are developing quickly.
But Guan and other experts do not consider an AI worm the leading practical AI threat. Anthropic’s version spreads very slowly, he said, and worms’ actions are predictable and detectable, making them possible to block at multiple levels. Strong passwords and two-factor authentication still protect against most worms and other intrusions.
The disagreement is partly about what the demonstration proves. Huang Andres Guerrero-Saade, vice president of research at SentinelOne, called the attack a striking trick that attracted too much attention amid alarming claims that models have minds and wills of their own. He said it is not yet a genuinely feasible or significant threat.
Joshua Saxe, who led development of Meta’s AI security system, takes the risk more seriously. He argues that security teams should treat these attacks like other waves of cyberattacks and focus on limiting the damage. Cybersecurity professionals, he said, are not taking such real-world risks seriously enough. Ariel Herbert-Voss, an early security researcher at OpenAI who now leads startup RunSybil, likewise argues that models’ ability to learn while operating sets AI worms apart from conventional ones, and that security teams need more resources to address the problem.
What the announcement leaves open
Chris Inglis, a former deputy director of the US National Security Agency and national cybersecurity director under Joe Biden, suggested that worms could also serve beneficial purposes. He said several prominent events in the past six months had confirmed that AI worms are possible. The harder question now, in his view, is how they will be used, contained and combined with other emerging technologies.
I think the important distinction is between showing that a worm can be built and showing that it can cause significant harm. The test makes the first case more concrete; the researchers’ own account of slow spread and today’s limits leaves the second unsettled. The announcement does not establish how often vulnerable devices would be exposed, or how quickly their owners could respond.
That uncertainty sits inside a wider argument about AI oversight. Many AI and security specialists outside Washington consider government oversight necessary, while Congress has introduced conflicting bills and the White House has created only a small commission to examine the issues. Gadi Evron, who is organizing the Unprompted AI security conference in San Francisco this month, says marketing explains some warnings from AI companies, but not the full picture. In his view, the labs are not warning the public enough, and nobody can stop the AI storm.
The immediate lesson is less dramatic than a self-replicating machine taking over the internet: old devices are hard to secure, and the people responsible for securing them need the resources to keep up. Whether AI makes that familiar problem materially harder remains the question the demonstration cannot answer.
Daily AI news
Every day we pick what actually matters in AI and explain it plainly — no hype, no filler. Subscribe if you want to follow where the industry is going.
Only what matters — every day
Follow on X