Anthropic recently warned of a rapid evolution in AI-backed cybersecurity threats, amid increasing probabilities of digital worms emerging that are capable of copying themselves and spreading automatically between internet-connected devices without direct human intervention.
The company's offensive research team revealed, in a recently published report, the development of malicious AI software that managed to spread independently across network-connected smart televisions. The researchers explained that the software distributed parts of its operations across 15 televisions, utilizing the computing power of each device to continue operating despite limited individual resources.
Nature of the Threat and Surpassing Traditional Viruses
AI worms differ from traditional viruses in their potential ability to adapt to different operating environments and exploit new security vulnerabilities to expand their spread, specifically in devices known as "Internet of Things" such as smart TVs and connected home appliances that often receive security updates at a slower pace compared to phones and computers.
The company's researchers suggested that these worms could become more executable by the end of 2026 if the current pace of development continues for models capable of executing complex tasks with limited computing resources. These threats recall a historical record of alarming attacks such as the "Morris" worm in 1988, the "Stuxnet" worm, and the "WannaCry" attacks.
Debate Between Technical Warning and Media Hype
Conversely, some experts believe that the current capabilities of AI worms do not justify them topping the list of risks; Jonas Guan, a PhD researcher at the University of Toronto, pointed out that the version presented by Anthropic spreads slowly. Juan Andres Guerrero-Saade, Vice President of Research at SentinelOne, questioned the practical impact of the experiment, considering it closer to a technical demonstration that was media-hyped.
What changes practically?
- Attacks rely on exploiting model capabilities to distribute software operations instead of depending on a single device.
- Potential worms target devices that are weak in security and lack continuous updates.
- Digital worms leave behavioral patterns that can be detected and blocked through basic protection mechanisms such as strong passwords and two-factor authentication.
For his part, Ariel Herbert-Voss, founder of RunSybil, emphasized that the current cybersecurity infrastructure is not fully prepared to handle the spread of these threats, calling for enhanced security team resources and rapid patching of vulnerabilities. In the same context, other experts such as Chris Inglis, former Deputy Director of the US National Security Agency, believe that the principles of self-propagation and adaptation could be utilized in defensive applications to detect vulnerabilities and patch them early across networks.