Anthropic's offensive research team has described a new, practical threat: a malicious AI program that spread autonomously through internet-connected smart televisions and could do the same inside other ordinary devices. The red team, as such internal testers are called, said their program split parts of itself among 15 televisions and was still able to function by using a bit of power from each.
Practical Threat Emerges
The report alarmed some professionals because the generally weak security of smart televisions and many other internet of things devices would be very hard to correct, even with a concerted effort.
Joshua Saxe, who led development of Meta's AI security effort, said, "It's something to worry about just like every other wave of cyber-attacks. We need to mitigate the possible effects." He added, "I'm concerned right now that folks in the cybersecurity community are not taking these kinds of real risks as seriously as they should be."
Historical Context of Worms
Self-replicating computer viruses, known as worms, have wreaked some of the worst havoc in internet history. The Morris worm of 1988 copied itself so rapidly that many infected machines slowed to a stop. The US and Israel brought worms into international espionage with Stuxnet, which sabotaged Iranian nuclear centrifuges. Other worms like NotPetya and WannaCry have caused tens of billions of dollars' worth of damage worldwide.
Many destructive worms have depended on known vulnerabilities that device owners have not patched. The Anthropic team predicted that a worm like theirs could be harder to stop because smart devices receive patches less often than phones or laptops. They theorized that an AI worm could keep adapting to other types of hardware by researching newly disclosed vulnerabilities.
Expert Reactions and Future Outlook
Ariel Herbert-Voss, an early security expert at OpenAI who now runs AI security startup RunSybil, said AI models can learn as they go, differentiating them from typical reproducing viruses. "We need to better enable our security teams. We need to be giving them more resources to fix problems," she said.
Chris Inglis, former deputy director of the National Security Agency and former National Cyber Director, suggested worms could be used for benevolent purposes. "The question of whether AI worms are plausible has been settled by several breakout events over the past six months," he said. "The better question is how we will employ them, counter them, and/or combine them with other emerging technologies."
Anthropic researchers said a successful AI worm would need more capability on less powerful devices than is possible right now, but current trends will make that feasible by year's end. Their research follows a paper by experts at the University of Toronto that infected a full-size computer and could spread to similar machines more rapidly than the television worm. Co-author and Toronto PhD student Jonas Guan said, "The capabilities have been developing very rapidly."
Guan and other experts said an AI worm should not top anyone's list of AI fears. The Anthropic version moves very slowly, and worms have predictable and detectable actions that can be blocked at multiple layers. Basic security hygiene, including strong passwords and two-factor authentication, would stop most worms, experts said.
Juan Andres Guerrero-Saade, vice-president of research at security firm SentinelOne, dismissed the threat: "Nothing about this is truly feasible or impactful. It's nifty stunt hacking that's getting way more amplification in service of the ridiculous doomer narratives that suggest models have a mind and will of their own."
Anthropic did not respond to an interview request. Outside Washington, many in the AI and security worlds believe greater government oversight of AI is now essential, but Congress has introduced conflicting bills and the White House has created only a small review board.
Security researchers weigh motivations behind fearful prognostications from AI companies, ranging from quasi-religious beliefs to seeking legislation to exclude rivals or hype anticipated valuations. Gadi Evron, running an AI security conference in San Francisco called Unprompted, said, "The claim that a lot of this is marketing is correct, but the reality dwarfs any PR. Whatever claims the labs are making, they are not warning us enough. We need to understand that nobody can stop the AI storm."
