Anthropic Built an AI Worm That Lives in Smart TVs. Your Fridge Is Next on the List

Most AI warnings come with a sci-fi soundtrack: rogue superintelligence, runaway robots, the end of work. Anthropic’s latest one is far more ordinary, which is exactly why security people are paying attention. It is about your television.

Anthropic’s offensive research team, the internal “red team” paid to attack the company’s own technology, published a report this week describing a malicious AI program that spread by itself through internet-connected smart TVs. According to The Guardian, the program split parts of itself across 15 televisions and still worked by borrowing a little computing power from each.

Why a worm, and why now

AI models normally need serious hardware, which has made them easy to picture living only in big datacentres that someone could switch off. Anthropic’s argument, as CNBC reported, is that small models may be only months away from copying themselves across everyday home devices such as smart ovens, fridges, vacuum cleaners and Android TV boxes. The Guardian says the company thinks current trends make that feasible by the end of the year.

Anthropic is careful to say its tests were simplified and fenced off from the real internet. This was not a fully rogue program loose in the wild. It was a demonstration that the pieces are close to fitting together.

A program that copies itself without tricking a human is what security people call a worm. The Guardian runs through the history: the Morris worm of 1988 slowed infected machines to a crawl, Stuxnet sabotaged Iranian nuclear centrifuges, and NotPetya and WannaCry caused tens of billions of dollars of damage worldwide.

The real problem is boring

Here is the uncomfortable bit. Many of history’s worst worms used known security holes that owners never patched, sometimes months after a fix was available. Smart devices are among the worst offenders. They rarely get updates, they run for years, and almost nobody checks what software their dishwasher is running.

Spread an AI across thousands of those devices and there is no single plug to pull. That is what Joshua Saxe, who led development of Meta’s AI security effort, was getting at when he told The Guardian that the risk needs mitigating “just like every other wave of cyber-attacks”, and that he worries the security community is not taking it seriously enough.

What it means for the rest of us

For regulators, this moves AI safety out of the lab and into consumer product rules. For manufacturers, it is another argument for automatic security updates and a clear end-of-support date on every connected gadget. For households, the advice is dull but useful: update what you can, change default passwords, and think twice before connecting a toaster to Wi-Fi.

It is also a reminder of the odd position AI labs are in. Anthropic is warning about a threat while building the very technology that makes it possible. Publishing the research is arguably the responsible move. It also means the people selling smart fridges now have a fresh reason to care about security, which is more than most of them have shown so far.

This is commentary based on published reporting.