Security researchers split over how urgently to confront Anthropic’s AI-worm threat

Security researcher challenges Anthropic’s claim of self-replicating AI

Small AI models spreading through insecure gadgets is a plausible threat, but Anthropic’s demonstration leaves a gap between that warning and a working internet worm. In interviews published by Engadget on October 31, experts accepted the possibility of future AI botnets while Georgia Tech professor Michael Bailey challenged what the company had actually shown.

Anthropic’s Frontier Red Team research raised the prospect of small models spreading across vulnerable connected devices and forming autonomous botnets—networks of compromised machines. The company suggested simpler versions might be only months away. That is a forecast, not evidence that such a network is already spreading outside a test environment.

Computerworld’s October 14 coverage described the proposed path: exploit security flaws in devices such as smart ovens or Android TV boxes, use their processing power, then move onward. In Anthropic’s scenario, distributing computation across those devices could let a system operate without large data centers and make it difficult to shut down at one central point.

The new interviews do not settle the timeline. Chris Canal, CEO of model-evaluation company EquiStamp, told Engadget he had expected to become seriously concerned around summer 2027, later than Anthropic’s forecast. He also acknowledged that the lab might have access to research information he lacked. Bailey agreed self-replicating models were likely to arrive, while leaving their form and consequences open.

Anthropic showed a model moving between devices and setting up inference—the process of running a model to produce answers—on each. But the experiment used an emulated network and a trivial exploit. Bailey said it did not compellingly demonstrate the proposed threat, particularly the ability to adapt to unfamiliar hardware without human help.

His objection also concerns what counts as replication. Bailey said the demonstration involved sharding, or splitting a model across machines, rather than copying a complete working model onto each newly compromised device. A plausible real-world version, he argued, might instead install a small coordination tool that receives instructions from elsewhere in the network.

It's going to change the economics between attackers and defenders.

Bailey’s comparison is with existing malware, not an absence of risk. Mirai already infected different kinds of devices, including routers and internet-connected cameras. Supporting a new chip architecture still required human work, at least recompiling the malware. AI could automate that adaptation, shifting work that attackers previously had to perform themselves.

There is another boundary to the experiment: Anthropic did not attempt to have the models retrain themselves. Bailey distinguished that from worms that can change their signatures and behavior. The experiment instead showed model copies passing notes to successors and improving at setting up inference over time.

Anthropic’s proposed mitigations reach beyond model design. It suggested internet service providers notify customers of infections and restrict their internet access to a short list of safe websites. It also pointed to the UK’s PSTI Act, which bans easily guessable default passwords on connected devices, as a possible regulatory approach.

Bailey likewise argued that even misbehaving AI agents would struggle against hardened devices. His recommended defenses are familiar:

Patch devices to address security flaws.

Isolate systems to limit exposure.

Use strong passwords and maintain good security hygiene.