Anthropic Research Explores How AI Malware Could Spread Through Everyday Devices

Highlights

• Anthropic's Frontier Red Team distributed a Google DeepMind Gemma model across 15 networked TV boxes that were individually too weak to run it.

• A separate sandbox experiment tested whether a larger AI model could help deploy a smaller Meta Llama model on target systems.

• Researchers did not demonstrate a fully autonomous AI worm capable of spreading and running independently across low-power devices.

• The findings highlight how compromised consumer electronics could potentially become part of a distributed computing network.

• Security experts caution that the underlying techniques build on established cybersecurity concepts, even as AI introduces new possibilities for adaptation and automation.

Anthropic Investigates AI Malware Across Consumer Devices

Anthropic is examining how artificial intelligence could change the way malicious software spreads across connected devices, including low-cost television boxes and other consumer electronics.

In research published on October 12, 2026, the company's Frontier Red Team explored whether AI models could be distributed across multiple weak computers and how AI systems might help move software between devices. The findings raise questions about the security of connected electronics as manufacturers continue to add computing capabilities to televisions, appliances and other everyday products.

The research does not demonstrate that household appliances are already hosting autonomous rogue AI systems. Instead, it investigates two related capabilities: distributing a model across multiple low-power devices and using one AI model to help deploy another model on target systems in a controlled environment.

Together, the experiments illustrate a possible future attack scenario in which compromised devices contribute computing resources to a distributed system. Such a network could potentially be harder to disable than an application running on a single server if it were able to spread between devices and operate without central infrastructure.

However, the researchers did not demonstrate that complete scenario. The experiments provide evidence of individual technical capabilities rather than proof of a fully self-replicating AI worm operating independently across consumer electronics.

Fifteen TV Boxes Combine to Run an AI Model

One experiment conducted by Anthropic's Frontier Red Team involved 15 inexpensive television boxes purchased and networked by the researchers.

Each device had insufficient computing power to run the entire AI model independently. The team addressed this limitation by distributing the model across the devices, allowing each box to process only part of the workload.

The researchers used a model from Google DeepMind's open-weight Gemma family. Large language models contain layers that progressively process information, making it possible to divide computation between multiple systems. In the experiment, individual TV boxes handled selected layers and passed the resulting information to the next device.

By chaining the boxes together, the researchers were able to run the complete model and receive responses using the combined computing resources of the network.

The experiment demonstrates that a device does not necessarily need a powerful processor to contribute to running an AI model. Several limited systems can collectively perform a task that would be beyond the capabilities of any one of them.

This capability has legitimate applications in distributed computing, but it also raises security questions. If an attacker gained control of multiple vulnerable devices, their combined resources could potentially be used for unauthorised computing activities.

The research does not establish that the 15 TV boxes were compromised by malware. They were devices deliberately purchased and connected by the research team to test distributed model execution.

A Separate Experiment Explores AI-Assisted Propagation

Anthropic also tested how AI models might help software move between systems in a virtual sandbox.

In this experiment, a larger model developed by Chinese AI startup Z.ai helped get a smaller model from Meta's Llama family running on target systems. The test explored whether an AI system could assist with the steps involved in deploying another model across a network.

There was an important limitation: the larger model was too big to run directly on the low-power target devices and continued to rely on a separate server.

Consequently, the researchers did not demonstrate an AI worm that could independently spread between weak devices, transfer its own model and continue operating without external computing support.

Anthropic's broader concern is that improvements in smaller AI models could eventually make the two demonstrated capabilities easier to combine. A sufficiently capable small model might be able to run on modest hardware while also helping with the process of spreading to additional systems.

That remains a prospective scenario rather than an established outcome of the experiments. The distinction matters because distributing computation and deploying software are not, by themselves, evidence of autonomous self-replication.

Why Distributed AI Could Complicate Cybersecurity

Computer worms are not new. They are malicious programs designed to propagate between systems, often by exploiting vulnerabilities or weaknesses in network security. Security researchers have also investigated ways of incorporating AI into malware to help it adapt to different environments or automate parts of an attack.

Anthropic's research explores a different possibility: an AI model could potentially be part of the distributed system itself, rather than merely serving as an additional component that assists conventional malicious software.

If future attackers could combine autonomous propagation with distributed model execution, they might be able to use compromised devices as computing resources while reducing dependence on a single central machine.

Such a system could potentially draw on a diverse collection of hardware, from personal computers to consumer electronics. But successfully exploiting that possibility would require overcoming significant technical and security obstacles, including obtaining access to devices, moving software between them, coordinating computation and maintaining reliable execution.

The research therefore highlights a potential direction for AI-related threats rather than demonstrating that an entirely new category of unstoppable malware has emerged.

Jeffrey Ladish, founder and executive director of AI safety nonprofit Palisade Research, told Scientific American that computing resources can come from many types of machines, including smart televisions and personal computers. His comments underscore the possibility that attackers could view compromised devices as a pool of distributed computing capacity.

Security Experts Point to Familiar Attack Techniques

The findings also prompted caution from cybersecurity experts who see substantial continuity with established security threats.

Computer scientist Vyas Sekar warned that techniques for creating such systems may not be limited to a small number of specialised research teams. His comments, reported by Scientific American, point to the accessibility of open-weight AI models and the possibility that experimentation could reproduce some of the demonstrated behaviours.

Open-weight models allow developers to obtain and run model parameters rather than relying exclusively on a hosted service. That flexibility supports legitimate research and local deployment, but it can also make certain capabilities available to actors who want to experiment outside centrally managed platforms.

The availability of models does not automatically make an AI worm feasible. Attackers would still need to overcome operating-system restrictions, device-specific hardware limitations, network protections and other barriers to execution and propagation.

For device manufacturers and operators, the broader implication is that connected hardware should be evaluated not only for its intended functionality but also for the ways it could be misused if compromised. Unnecessary network exposure, weak authentication, unpatched software and inadequate restrictions on device behaviour can create opportunities for conventional malware as well as more sophisticated AI-assisted attacks.

The Research Highlights a Potential Future Risk, Not a Proven Threat

Anthropic's experiments illustrate how AI capabilities and distributed computing could intersect in ways that complicate future cybersecurity planning.

The company showed that a model could be divided across 15 low-cost TV boxes and separately explored AI-assisted deployment of a smaller model in a sandbox. It did not demonstrate a self-sustaining AI worm capable of spreading and operating entirely on weak consumer devices without a separate server.

That distinction is central to interpreting the findings. The work identifies technical building blocks that could become more consequential as smaller models improve and connected devices become more capable, but the full attack scenario remains unproven.

For the cybersecurity industry, the immediate lesson is to continue strengthening protections for connected devices while examining how AI could change the scale and adaptability of existing threats. The potential for distributed AI malware deserves attention, but claims about autonomous systems silently spreading through household appliances should remain grounded in what research has actually demonstrated.