Anthropic’s warning that small artificial intelligence models may soon behave like computer worms points to a new vulnerability in the expanding digital layer of urban life: the growing number of ordinary devices connected to the internet. The concern is not that an AI worm has already been shown spreading across consumer gadgets, but that the technical conditions for such an attack may emerge within months as AI models become smaller and household devices carry more computing power.
The researchers’ assessment, published on Anthropic’s blog late Monday, places the risk at the intersection of two trends. Technology companies are moving AI capabilities away from distant data centres and into phones, laptops, cars and household devices. At the same time, many consumer gadgets remain inexpensive, widely distributed and difficult to secure consistently. That combination could create a large attack surface inside homes, offices and other urban spaces.
A conventional computer worm is malicious software that copies itself from one machine to another without requiring human assistance. Anthropic researchers William Zhou and Daniel Freeman said a future AI version could operate in a similar way, using small models embedded in or transferred between internet-connected devices. Unlike the most powerful AI systems, such a model would not necessarily need access to a large data centre to function.
That distinction is important because it shifts the security problem from a small number of highly visible digital platforms to a much larger population of everyday equipment. The researchers said an AI worm could potentially run on cheap, poorly secured consumer devices, including smart TV boxes and kitchen appliances. The supplied findings do not establish that such a worm currently exists in the wild. They describe an estimated capability based on the direction of hardware and AI development.
The risk therefore comes from the structure of connected-device networks as much as from artificial intelligence itself. A smart device is often purchased as a finished product, installed in a home and left connected for years. Its owner may not know which software it runs, whether it continues to receive security updates or how easily its default credentials can be changed. When millions of such devices are connected, a weakness in one category of product can become relevant to a much wider network.
Anthropic compared its estimate with Kimwolf, a botnet that reportedly infected more than two million devices at its peak, mostly off-brand Android TV boxes. A botnet is a network of hijacked devices controlled by attackers. The comparison provides a scale reference for how vulnerable, low-cost connected hardware can become part of a distributed security incident, although the researchers also acknowledged that their estimate was based on one type of gadget and one past botnet.
The comparison also reveals a key difference between the existing botnet problem and the AI-worm scenario described by Anthropic. A conventional botnet depends on attackers controlling compromised devices, while an AI worm would be designed to copy itself from one device to another. The researchers said such a process would probably be slow, taking days to spread, and likened its behaviour to slime mould or a swarm of fruit flies. Speed, in this case, would not necessarily determine the difficulty of containment.
The more difficult issue is the absence of a single point at which the infection could be stopped. Anthropic researchers said an AI worm would be hard to stamp out once created because there would be no central switch to turn it off. The observation highlights a governance problem embedded in connected-device infrastructure: responsibility is divided among device manufacturers, software providers, internet-service providers, platform companies and consumers.
A data centre can often be monitored by a defined operator, and a major online service may have a central security team capable of disabling a compromised function. A city full of connected televisions, appliances, vehicles and personal devices does not have one equivalent administrator. Each product may have a different manufacturer, update policy, operating system and replacement cycle. The technical vulnerability is consequently tied to an institutional gap over who can act across the full chain of devices.
The researchers’ warning comes as technology companies race to place more powerful AI directly into phones, laptops, cars and household devices. Running models locally can reduce dependence on remote data centres and may allow devices to respond without sending every task to an external server. But the same shift increases the amount of computing capability distributed through homes and public-facing environments.
That distributed design changes the urban technology map. Connected devices are no longer limited to specialist infrastructure. They are becoming part of domestic energy use, entertainment, mobility, communications and building operations. The source material does not claim that an AI worm would disrupt any particular city service, building system or transport network. It does, however, identify a direction in which the boundary between personal gadgets and broader digital infrastructure could become less clear.
The central uncertainty is technical. Anthropic described its estimate as rough because it was based on one type of gadget and one previous botnet. The researchers also said that the amount of computing power in everyday devices is expected to keep increasing, while the AI models needed to carry out such an attack are likely to become smaller. These are projections about technological development, not evidence that a specific attack is imminent.
That distinction matters for public reporting and for security policy. Treating the warning as proof of an active AI-worm outbreak would overstate the evidence. Treating it as a purely speculative issue would overlook the conditions already visible in the consumer-device market: large numbers of low-cost connected products, uneven security, distributed ownership and a growing capacity to run AI locally.
The policy challenge is therefore broader than regulating AI models in isolation. It concerns the security lifecycle of the devices on which those models may operate. The supplied material does not identify a specific government standard, liability framework or enforcement mechanism for preventing the risk. It does show why responsibility may become difficult to assign if a future infection crosses products made by different companies and operates across networks managed by different parties.
For cities, the issue is especially relevant because urban digitalisation depends on scale. Connected devices are valuable partly because they are numerous and able to communicate. The same scale can magnify weaknesses when devices are poorly secured or abandoned by their manufacturers. A security incident involving a single device may be limited; a self-propagating system could make the number, diversity and geographical spread of devices part of the threat.
The Kimwolf comparison also places the warning within a known pattern rather than presenting it as an entirely new category of risk. Internet-connected devices have previously been assembled into large botnets. What changes with AI is the possibility that the malicious software could require less central infrastructure and operate with greater autonomy. Anthropic’s account does not establish how such a system would be built, what devices it could infect or whether it could evade existing security controls.
The evidence currently confirms an emerging risk assessment, not a completed incident. Anthropic’s researchers have linked the possibility of AI worms to smaller models, increasing computing power in ordinary gadgets and the precedent of large device botnets. The questions that remain open include whether a workable AI worm can be developed, how quickly it could spread, which devices would be vulnerable and which institution could coordinate a response.
As AI moves into more parts of the built environment, those questions will become harder to separate from ordinary infrastructure security. The warning’s significance lies less in a claim that smart homes are already under attack than in the possibility that future digital systems may distribute both computing power and cyber risk across millions of devices with no single operator responsible for all of them.
