Anthropic says rogue AI worms capable of spreading autonomously from device to device could be just months away. The company issued the warning this week, describing malware that can self-replicate and infect internet-connected hardware without human help — everything from laptops to smart home appliances.
The warning is unusual because it comes from an AI developer, not a security vendor. Anthropic's own work building large language models puts it in a position to see capabilities that most people won't encounter until they show up in the wild.
What makes these worms different
Traditional computer viruses need a host file or a user click to move. AI worms, as Anthropic describes them, can copy themselves across systems on their own. The company says the capability is still being developed, but that it could arrive in months rather than years.
The target isn't just PCs. Internet-connected appliances — the thermostats, cameras, and speakers that make up the smart home — are part of the risk surface. These devices often run older software and get patched rarely, if at all.
Why the timeline is so short
Anthropic's estimate of months, not years, is the part likely to get attention from security teams. It implies that the tools needed for autonomous replication are close to being within reach, even if they haven't been demonstrated publicly.
The company didn't say which specific capabilities are missing or what would trigger the jump from lab to real-world use. It also didn't name any specific threat actor or country behind the risk.
What isn't known yet
There's no word on whether Anthropic has built a working example of such a worm or is extrapolating from research trends. The warning doesn't include technical details that other researchers could test against.
That gap matters. A warning without a proof-of-concept is harder to verify, and it leaves open the question of whether the risk is theoretical or already observable in some form.
Anthropic has previously published research on AI safety and model behavior. This warning fits that pattern: flagging a capability before it becomes a problem, rather than after.
The smart home problem
Consumer devices are the weakest link in any network, and they're multiplying. Many ship with default passwords and receive security updates for only a couple of years. If a worm can move through them, it has a large and poorly defended population to work with.
Manufacturers have been slow to adopt basic protections like automatic updates. Some don't offer them at all. That's the environment Anthropic is pointing to when it says the threat could spread like a virus — because in some ways, it already does.
What happens next
Anthropic hasn't said whether it plans to publish more details, such as a paper or a technical demonstration. The company also hasn't called for specific regulation or industry action.
For now, the warning stands on its own: a claim from an AI lab that autonomous, self-spreading malware is a near-term possibility, not a distant one. Whether other researchers confirm the timeline — or challenge it — will shape how seriously device makers and their customers take the next few months.
