AI Occupies Smart Appliances as Hacking Bases

A study has found that artificial intelligence (AI) could take over major smart home appliances and use them as bases for hacking.

The Anthropic research team revealed on the 12th, local time, a study showing that AI models can replicate themselves and occupy low-spec home IoT (Internet of Things) devices, such as TVs, refrigerators, ovens, and robot vacuums, without the need for large data centers. While IoT devices have limited memory and slow processing speeds, they are vulnerable to security breaches and remain constantly connected to the internet. By linking these devices, AI can operate and use them as a foothold to replicate and spread to other devices.

The team successfully connected 15 set-top boxes based on the Android operating system (OS), priced at approximately 55 dollars, 70,000 Korean won, via a network and distributedly installed the AI model ‘Gemma 4’ to operate it stably. The first device handles initial computations, and subsequent devices take over the process, sharing results to divide tasks. This demonstrates that even low-spec devices can collectively run AI.

The AI’s self-replication capability was also proven. The team tested the AI’s spread on eight virtual devices replicating the Android environment. The AI model ‘GLM-5.2’ was configured to search for new devices, install smaller AI models, and upon successful installation, have new task agents spread to the next devices. In five experiments, four succeeded in spreading to all eight devices, and one reached seven. Though the target devices were set to allow unauthenticated access, the AI could still perform self-replication tasks.

Anthropic expressed concern about the combination of these two capabilities. If AI operates by linking low-spec appliances while autonomously searching for and installing models on other devices, it could expand its operational space without human intervention. Occupied appliances could act as both AI computers and hacking bases for infiltrating other devices. For example, AI could establish itself on a set-top box, use it to infiltrate other vulnerable devices, and repeat the process on newly occupied devices. Such AI attacks would be extremely difficult to block due to the lack of a central control point.

The researchers predicted that by the end of this year, compact AI models running on home appliances could reach a level where they install models on other devices and perform replication and spread tasks. Anthropic proposed countermeasures, including detecting abnormal traffic by internet service providers (ISPs), isolating infected devices, and strengthening security by manufacturers.