Anthropic warns AI‑worms could self‑replicate in smart‑home appliances

Researchers at Anthropic warned on October 16, 2026 that malicious software based on artificial intelligence could soon nest inside connected household appliances and spread automatically between devices, creating a new kind of cyber threat they call "AI-worms." The company says such software might not need powerful data‑center hardware and could exploit poorly secured smart TVs or other internet‑connected home devices.

Experimental spread on cheap Android TV hardware

In a controlled experiment Anthropic distributed an AI model across 15 inexpensive Android‑TV units so that each device handled part of the computation. They then added eight simulated Android devices as targets. The model managed to embed itself in one target device, replicate, and infect the others; in four out of five attempts it reached all eight targets, and in the remaining attempt it reached seven out of eight.

According to Anthropic's programmers, a single AI‑driven worm could learn to adapt to different operating environments and work around updated security settings. They estimate that such a worm might take "one to two days" to embed itself into a previously unknown device.

Anthropic also warned that compromised appliances could be linked into large botnets: a single infected unit has limited compute power, but as more devices are taken over the aggregate capacity grows and the malicious software no longer depends on a central server. The company compared this possible development to a slow‑growing "slimy digital mold."

The warnings come against a backdrop of widespread smart‑home adoption: the German industry association Bitkom says roughly half of households already use smart‑home solutions, and one image caption in the report cites 52 percent of German households with such devices.

The potential reach of attacks on networked equipment was illustrated by a cyber incident in France on the night between October 11 and October 12, 2026, when attackers manipulated refrigeration systems at several supermarkets. Temperatures in affected stores reportedly rose to as high as 50 degrees Celsius, causing food spoilage and in isolated cases fires and technical damage. French authorities initially identified compromised remote units from the Danish manufacturer Danfoss, and later extended warnings to controllers from other vendors; the investigation is ongoing.

French cybersecurity authorities have urged companies to keep networked devices up to date, install all necessary security updates, and immediately disable any unnecessary internet access to reduce the risk of further incidents.

Photo: press material from the event