A TV, a refrigerator, a camera and other home devices connected to the Internet could, in the future, contribute to the spread of malware without the user realizing it. It’s nothing new that they can be targeted by hackers, but artificial intelligence could change the way some malicious programs propagate from device to device. This is suggested by new research conducted by Anthropic, the company that develops Claude. The experiments examined some capabilities necessary for this autonomous diffusion, obtaining significant results under controlled conditions. However, an infection of real household appliances by an AI capable of replicating itself without external intervention has not been demonstrated.
What are AI worms and how would they work
The mechanism hypothesized by the researchers recalls that of worms, malicious programs that can replicate themselves autonomously across a network, passing from one computer to another. Unlike computer viruses in the strict sense, which infect files or programs to reproduce, worms can locate other devices and exploit their vulnerabilities to spread.
An AI worm would follow the same principle, with one difference: instead of relying only on pre-established instructions, it would use artificial intelligence to adapt to the systems it encounters. It could, for example, analyze the characteristics of a device, identify the software necessary for its operation and correct any errors during configuration. After entering a vulnerable device, it could transfer its weights, i.e. the numerical values that define the AI model, to it or download them from the Internet. It should then set up the computing environment to run the model and attempt to reach other devices.
What Anthropic’s experiments showed
One of the difficulties for an AI worm would be to be able to make an artificial intelligence model work even on less powerful devices. To test this possibility, Anthropic researchers used 15 Android TV boxes costing around $55 each. These are small devices that connect to your television to add multimedia features. Each box had 4 GB of RAM, an insufficient amount of memory to independently run Gemma4-26B-A4B, a language model, i.e. an AI system capable of processing instructions and generating text or computer code.
The researchers then divided the model into several parts, distributing them among the devices connected to the network. This way they managed to make it run at a speed of 0.39 tokens per second. A token is a unit of text processed by AI, which can correspond to a whole word or a part of it. The performance was very low, but the test showed that even cheap devices can share their resources to run a system that they couldn’t handle on their own.
Another experiment involved AI’s ability to adapt to different hardware components. The Qwen3.5-9B model was able to configure the software needed to run another AI system on eight of the nine types of equipment tested. This is an important step, because a possible AI worm should also be able to work on devices other than those for which it was initially configured.
The replication test was instead carried out in a separate environment. Anthropic set up an isolated network of eight virtual computers that simulated the operation of Android devices and tested whether an AI agent was capable of identifying other devices, reaching them and preparing the software necessary for the operation of a model. The GLM-5.2 completed all eight nodes in four out of five trials, achieving seven in the remainder.
However, the test was conducted under simplified conditions. Access to the machines had been facilitated by leaving a communication port available without authentication. Furthermore, GLM-5.2 ran on a server external to the experimental network: on the reached devices it configured a smaller model to run, while the test infrastructure started a new copy of the agent. Therefore, the ability of a single model to transfer and run independently on different devices has not been demonstrated.
According to Anthropic, relatively small AI models, with up to 30 billion parameters, could achieve the capabilities needed to complete the entire replication procedure by the end of 2026. However, this is a prediction based on the trend of technological progress, not a certainty. Currently, in fact, these systems are able to carry out many of the individual operations required, but still encounter difficulties in combining them.
Then there are practical limits. On cheap devices processing can be very slow. According to a theoretical estimate from the researchers, a system based on Qwen3.5-9B could take 28 to 51 hours to complete the configuration necessary to run an AI model on low-powered hardware. The transfer of large amounts of data and continuous communication between devices would also generate anomalous network traffic, which could help security systems detect a possible infection.
What are the risks for household appliances and how to protect yourself
The possible involvement of household appliances is also explained by the characteristics of the Internet of Things (IoT), the set of physical objects connected to the Internet. Refrigerators, ovens, robot vacuum cleaners and smart cameras can integrate processors, memory and operating systems to communicate with applications or manage their functions. Some also have chips designed to run AI models directly on the device.
The presence of these components does not automatically make an appliance vulnerable. The risk increases especially in the presence of unchanged default passwords, as well as uncorrected security flaws and absent updates, conditions which can particularly affect products that are less protected or no longer supported by manufacturers.
A significant precedent is represented by Kimwolf, a botnet that involved over two million devices, mostly Android TV boxes. Botnets are networks of compromised devices that can be exploited to conduct cyberattacks. The case demonstrates how widespread this phenomenon can be even without resorting to artificial intelligence.
A compromised appliance could be used to make computing resources available, participate in cyber attacks or attempt to reach other devices connected to the same network. This does not mean, however, that whoever manages to infect it can automatically control its physical functions, such as the temperature of a refrigerator. The possibility of modifying them would depend on the type of access obtained and the commands actually available. A concrete example, although different from the AI worm scenario, is the recent hacker attack on the refrigeration systems of hundreds of French supermarkets, during which the attackers managed to remotely alter the defrost cycles.
John Walsh, cybersecurity expert at IGEL, warned that such a threat could also affect food production or water treatment plants. However, these are potential scenarios. Compromising a home device is not the same as gaining access to the systems that control an industrial infrastructure.
To reduce these risks, it is important to take certain precautions, such as changing the default credentials of the devices and regularly installing updates as they become available. When possible, it’s also helpful to connect smart objects to a separate Wi-Fi network from the one used for computers and smartphones, and turn off remote access when not needed.
