Security researchers split over how urgently to confront Anthropic’s AI-worm threat

Security researchers are divided over how urgently defenders should prepare for AI worms on household gadgets. In October 18 Guardian reporting, former Meta AI-security leader Joshua Saxe warned that cybersecurity professionals were underestimating the risk. Toronto researcher Jonas Guan countered that Anthropic’s experimental approach was slow and involved predictable actions that defenders could block.

Prepare now, or turn down the alarm?

Saxe, who led development of Meta’s AI security effort, called for mitigating the possible effects as with any other wave of cyberattacks. Anthropic identifies poorly defended internet-connected home and small-business devices as potential early targets for models that could copy themselves between machines without human input—the defining behavior of a computer worm.

Guan, a University of Toronto researcher who co-authored earlier AI-worm research, emphasized detectability rather than inevitability. Worms perform recognizable actions that can be stopped at several layers, he said. Experts cited by the Guardian also said strong passwords and two-factor authentication would stop most worms and other hacking.

SentinelOne research vice-president Juan Andres Guerrero-Saade went further, criticizing the attention given to the demonstration and its use in narratives that portray models as having minds and wills of their own.

Nothing about this is truly feasible or impactful

Juan Andres Guerrero-Saade, SentinelOne vice-president of research, speaking to the Guardian

Two experiments, not an autonomous TV infection

The dispute concerns research William Zhou and Daniel Freeman published October 12. Anthropic ran Gemma4-26B-A4B across 15 off-brand Android TV boxes at 0.39 tokens, or pieces of text, per second. Each box held part of the model. That showed distributed inference—several devices jointly producing model output—not those boxes infecting one another.

A separate eight-node cloud test emulated Android devices. GLM-5.2 coordinated deployment of a smaller Llama model and continued propagation, but the controlling model ran on an external inference server. Access was deliberately unauthenticated. Anthropic called that simplified setup an upper bound on real-world success; other tested open-weight models failed to complete the sequence.

The forecast behind the warning

Anthropic’s timeline is conditional: if small models improve at their historical rate, they could match the simplified replication capability by the end of 2026. Small models carrying their own learned weights as malware could become possible soon afterward. The proposed danger is adaptation to unfamiliar devices, coupled with no central shutdown point.

That future risk competes with a present one. University of Illinois assistant professor Varun Chandrasekaran told AFP on October 13 that Anthropic’s work had not been independently verified. His assessment was that human attackers using AI to sharpen their hacks remained the biggest current AI-related threat—and were already operating at scale.