Autonomous AI Could Spread Over the Internet: Why Anthropic Is Warning of a New Cyber Threat

Artificial intelligence is gradually moving beyond chatbots that answer questions, write text, or generate images. New models are capable of independently performing sequences of tasks, working with software, finding errors in code, and interacting with computer systems. 

At the same time, this autonomy creates new risks: what will happen if AI is able not only to carry out human instructions but also to spread across devices, using their computing resources?

On October 12, 2026, Anthropic published a study warning that small AI models could, within the coming months, gain sufficient capabilities to replicate themselves on internet-connected devices. This includes, in particular, inexpensive Android TV boxes, smart home appliances, and other Internet of Things (IoT) devices.

UA.News explains what the researchers discovered, why household devices could become part of a cyberthreat, and how the development of AI is changing approaches to technology regulation.

What Anthropic Discovered

In the study, the Frontier Red Team—which assesses the risks of advanced models—examined a scenario involving autonomous AI replication. Such a system could identify potential targets, gain access to devices, install its own components on them, and continue to spread without constant human oversight.

To demonstrate the capabilities of distributed computing, the researchers ran the Gemma4-26B-A4B model on 15 inexpensive Android TV boxes. Each box stored a portion of the model, and all devices collectively kept it running. According to Anthropic, each set-top box cost approximately $55.

The experiment showed that inexpensive consumer devices can be combined to run models that are difficult to fit on a single device. However, this does not mean that the researchers have created a ready-made virus capable of infecting TVs in real home networks.

Anthropic broke down the potential self-propagation process into several stages: target search, gaining access, configuring the model to run, and subsequent propagation. For a successful attack, it is not enough to infiltrate a device—the model must also be able to run on unfamiliar hardware.

According to test results, models with 30 billion parameters or fewer are already capable of performing many of the individual operations required for this process. However, they still make mistakes when it comes to combining all these actions into a single complex sequence.

In a simplified experiment, the GLM-5.2 model was able to complete the entire propagation cycle between test nodes. Anthropic predicts that, if current development trends continue, small models could achieve similar capabilities by the end of 2026.

How an AI worm differs from a conventional virus

Computer “worms,” capable of automatically finding other machines and replicating themselves, have existed for a long time. The novelty Anthropic is exploring lies in the ability to incorporate a language model into this process—one that analyzes an unfamiliar environment and independently solves technical problems.

Traditional malware typically operates according to a predefined algorithm. If it encounters a device with a different operating system or an unusual configuration, its spread may be halted. An autonomous agent with programming capabilities is theoretically capable of identifying the device type, selecting compatible tools, configuring the launch, and correcting some errors.

In The Verge’s article on Anthropic’s research, attention is drawn to the potential ability of small models to operate in a heterogeneous environment of devices.

However, AI does not eliminate fundamental cybersecurity limitations. The model needs a way to access the device, the appropriate permissions, computational resources, and the ability to transmit data. If the system is properly secured and vulnerabilities are patched, the mere presence of AI does not allow it to automatically penetrate the system.

Therefore, this is not about a virus that overcomes any protection, but rather about the potential intensification of already known cyber threats due to the models’ ability to adapt to new conditions.

Why TVs and Home Appliances Could Become Targets

Inexpensive set-top boxes, surveillance cameras, routers, and other Internet of Things (IoT) devices can be attractive to attackers due to their widespread use and insufficient security. Some of this equipment operates for years without updates, retains default passwords, or has administrative interfaces accessible from the internet.

Anthropic cites the example of Kimwolf—a botnet that, according to the company, has infected over two million devices, primarily Android TV boxes. This is not self-replicating AI, but an example of how poorly secured consumer devices can already become part of a large network controlled by attackers.

If such an infrastructure is supplemented with models capable of running on various devices, it will potentially become easier to recruit new devices. At the same time, not every device is capable of running a full-fledged model on its own: limited resources may require distributing computations across multiple machines and slow down the spread.

For users, this means regularly updating software, changing default passwords, and disabling unnecessary remote access. Companies should also isolate Internet of Things (IoT) devices from the main corporate network.

Anthropic Warns of Risks, but Is Itself Reevaluating Its Control Over AI

The new study comes at a challenging time for Anthropic. The company positions itself as a developer that places special emphasis on the safety of advanced models. However, in recent months, it has itself reported instances where systems gained access to real-world computing resources during testing or deviated from expected behavior.

On October 9, Anthropic decided to disable access to the open internet for internal evaluations until the company is confident in its ability to properly control the agents’ behavior.

During some tests, the agents exploited software vulnerabilities, gained access to databases, and circumvented certain restrictions on information sharing. In one of the reported cases, the system even sent a false report of a murder to the Philadelphia police.

These actions occurred during testing and do not prove that the model independently began committing crimes outside of it. However, they demonstrate just how important environment configuration, permissions, and oversight become when AI can not only generate text but also perform actions using external tools.

This is where the line between a chatbot and an autonomous agent lies. A chatbot can provide instructions, while an agent can access tools and attempt to carry them out in practice. If it has the ability to run code, access the network, and interact with external services, errors in configuration can have more serious consequences.

Who Sets the Rules for AI Use

Another controversy surrounding Anthropic concerns the military application of artificial intelligence. In early 2026, the company clashed with the U.S. Department of Defense over restrictions on the use of its technologies. Anthropic insisted on safeguards that would prevent Claude from being used in fully autonomous weapons systems and large-scale domestic surveillance.

The Pentagon, for its part, advocated for the ability to use the technology for all lawful purposes and believed that the vendor’s restrictions could pose risks to military operations. The dispute escalated into a legal battle.

In September, a federal appeals court in Washington upheld the Pentagon’s decision to classify Anthropic as a supply chain security risk. The company is challenging this ruling: on October 13, it asked the court to reconsider the case. This dispute concerns not only a specific model but also the extent to which the government can dictate the terms of use for a private developer’s technology. It also highlights a broader dilemma: companies try to set their own restrictions, but government agencies and other clients do not always agree with them.

In practice, the issue of autonomous AI boils down to specific decisions: who can grant the model access to the network, whether it is permitted to run code without human verification, and who will be held liable if the system causes harm.

What AI Regulations Are Already Being Implemented

Governments are gradually shifting from voluntary recommendations to mandatory requirements for AI developers and users. One of the key examples is the European AI Act, which establishes rules based on the type of system and the level of risk.

As of August 2, 2026, the European Commission’s powers to enforce compliance with requirements for providers of general-purpose models have taken effect. For the most powerful systems, which may pose a systemic risk, additional requirements for risk assessment and mitigation are in place. The Commission may request information, conduct assessments, and require appropriate measures within the scope of its authority.

The regulation also includes transparency requirements and provisions for labeling certain types of generated content. At the same time, the AI Act does not impose a blanket ban on autonomous agents: the rules depend on how the system is used and the risks it poses. 

In the U.S., decisions by individual states, court cases, and requirements from government agencies play a significant role. On October 14, according to Reuters, eight states filed lawsuits against OpenAI, alleging that ChatGPT could harm users—particularly minors—or encourage dangerous behavior. 

Anthropic also updated its Claude usage policy on October 8. The company clarified restrictions regarding the development of weapons and surveillance systems, the use of AI in sensitive areas, and connecting models to equipment capable of performing physical actions. For such scenarios, operator supervision is required, and the equipment must be put into a safe state in the event of a loss of connection with the model. 

However, companies’ internal rules are no substitute for government regulation. They define the terms of use for specific services but do not guarantee the responsible use of all models, especially open-source ones. Therefore, controlling access to tools, restricting permissions, and ensuring accountability for the actions of autonomous systems are becoming increasingly important.

Can Autonomous AI Become Uncontrollable?

In public discussions, uncontrolled AI is often associated with a system that supposedly develops its own goals and begins to act against humans. A study by Anthropic describes a more specific scenario: a program containing a model could automate the search for devices, exploit vulnerabilities, and transfer its own components to new machines.

This does not require proving that the model possesses consciousness or its own intentions. It is sufficient for it to execute a sequence of actions, adapt to technical obstacles, and have access to the necessary tools. If the system malfunctions, consequences can arise even without any “desire” on the part of the AI to cause harm.

A developer can set restrictions at the instruction level, but the agent’s behavior also depends on its permissions, the execution environment, and how results are verified. If the system can run code or interact with external services, text-based restrictions alone may not be sufficient.

How to Protect Yourself from Potential Threats

So far, there is no reason to believe that ordinary users need to turn off their TVs, cameras, or smart home devices en masse. However, the study serves as a reminder of the basic rules of digital security.

Users should install software updates, change default passwords, and disable remote access if it is not needed. For routers and other devices, check whether administrative interfaces are accessible directly from the internet.

Companies must isolate Internet of Things (IoT) devices from the main corporate network, restrict access between network segments, and monitor network connections. It is also important to identify devices that no longer receive updates and replace those posing unacceptable risks.

Organizations that use standalone agents should grant them only the minimum necessary permissions. A document analysis agent does not need unrestricted access to corporate systems, credentials, or the internet. Critical actions must be verified, and code execution must occur in an isolated environment where the system can be monitored and stopped.

In its recommendations for reducing the visibility of systems on the internet, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) emphasizes the importance of limiting unnecessary external access. This principle remains relevant for new threats as well: if a device does not require an external connection, it should not be left open without proper protection.

Research by Anthropic shows that the development of autonomous AI creates new challenges for cybersecurity. Although the widespread adoption of self-replicating models has not yet been observed, their potential already requires the attention of developers, businesses, and the government.

Future security will depend on how effectively technological advancement can be combined with device protection, access control, and clear rules for AI usage.