Small artificial intelligence models could eventually become capable of moving independently between internet-connected devices, raising concerns about a new category of cybersecurity threats, according to research from AI company Anthropic.

Researchers examined whether increasingly compact AI models could operate on ordinary consumer electronics rather than relying on powerful cloud data centers. Their analysis suggests that as AI models become smaller and computing capabilities inside everyday devices improve, malicious software incorporating AI could potentially reproduce across networks with limited human involvement.

How AI Worms Could Spread Across Connected Devices

Traditional computer worms are malicious programs designed to replicate automatically and move from one vulnerable computer or device to another. Researchers are now examining whether small AI models could eventually provide similar malware with more autonomous capabilities.

Under the scenario studied by Anthropic researchers, an AI-powered worm could potentially operate on relatively inexpensive connected hardware. Vulnerable smart-home products, streaming devices and other poorly secured electronics could provide possible pathways for propagation.

Unlike conventional cloud-based AI applications, such malware would not necessarily depend on maintaining access to a centralized data center. Copies operating on individual devices could potentially continue spreading even if other parts of the network were disrupted.

Researchers cautioned, however, that this remains a prospective cybersecurity risk rather than evidence that autonomous AI worms are currently spreading through consumer devices.

Past Botnets Offer Clues About Potential Scale

To estimate how widely such malicious software might eventually spread, the researchers considered examples of botnets consisting of large numbers of compromised internet-connected devices.

Botnets demonstrate how security weaknesses across consumer electronics can allow attackers to assemble extensive networks of infected hardware. The research used past botnet behavior as a reference point for considering what could happen if sufficiently capable small AI models were incorporated into self-propagating malware.

An AI-based worm might spread relatively slowly, potentially requiring days to reproduce and move between compatible devices. However, decentralization could make eliminating every infected copy more challenging because there may not be a single central system that defenders can simply shut down.

The researchers acknowledged significant uncertainty around such estimates because the calculations depend on assumptions about particular devices, networks and previous malware outbreaks.

Weak Smart Device Security Remains A Concern

Security specialists have long warned that some internet-connected consumer products receive weaker cybersecurity protections than conventional computers and smartphones.

Smart cameras, entertainment devices, appliances and other Internet of Things products can remain connected for years. Poor password practices, outdated software and limited security updates can increase their exposure to attacks.

As manufacturers place more computing power and AI functionality directly inside consumer products, securing those devices could become increasingly important.

Independent researchers have also cautioned that projections about autonomous AI malware need further study and verification. The practical capabilities of a future AI worm would depend on factors including model size, available computing resources, network access and security protections on individual devices.

Human Attackers Using AI Are The More Immediate Threat

Despite concerns about increasingly autonomous malware, cybersecurity experts say a more immediate problem is people using AI tools to improve existing attacks.

AI can help malicious actors work faster in areas such as identifying vulnerabilities, developing deceptive messages or modifying malicious code. This means cybersecurity organizations must address both existing human-directed attacks and possible future threats involving greater AI autonomy.

The broader debate has intensified as AI systems become increasingly capable of performing multi-step tasks with less supervision.

These developments have also fueled discussions among governments, researchers and technology companies over how AI safety standards should evolve. Some industry leaders are calling for stronger and more consistent safeguards, while debates continue over how much regulation is appropriate and whether mandatory rules could affect innovation and competition.

Anthropic's research does not establish that self-spreading AI worms are already operating across smart devices. Instead, it highlights a potential future risk as compact AI models become more capable and consumer hardware becomes increasingly powerful.

For users and manufacturers, the findings reinforce a familiar cybersecurity priority: connected devices need strong passwords, timely software updates, secure network configurations and continued security support. As artificial intelligence moves from cloud data centers into everyday electronics, protecting those devices could become an increasingly important part of limiting future cyber threats.