Anthropic red team builds AI worm that spreads across smart TVs

Anthropic's offensive research team, known internally as its red team, said in a report released in October 2026 that it had created a malicious AI program able to spread on its own through internet-connected smart televisions. The researchers said the same approach could work on other everyday devices.

Running AI usually demands significant computing resources. According to the team, their program distributed pieces of itself across 15 televisions and continued to operate by drawing a small amount of power from each. The researchers acknowledged that a fully successful AI worm would need more capability on weak hardware than is currently possible, but predicted that present trends would make it feasible by the end of the year.

Why it worries some experts

Worms are self-copying programs that spread without tricking a human, and past examples such as the 1988 Morris worm, Stuxnet, NotPetya and WannaCry caused some of the internet's worst damage. Anthropic's team noted that smart devices are patched less often than phones or laptops, which could make such a worm harder to contain. They also theorised that an AI worm could keep adapting to new hardware by researching freshly disclosed vulnerabilities.

Joshua Saxe, who led Meta's AI security work, said the cybersecurity community was not treating such risks seriously enough. Ariel Herbert-Voss, an early OpenAI security expert who now runs the startup RunSybil, said the ability of AI models to learn as they go sets these worms apart, and that existing defences are unprepared. Chris Inglis, a former National Cyber Director, suggested worms could also be put to benevolent uses.

The sceptics

Others were unconvinced. Jonas Guan, a University of Toronto PhD student who co-authored an earlier paper on a worm that infected a full-size computer, said Anthropic's version moves very slowly and that worm behaviour is predictable and can be blocked at several layers. Experts said basic hygiene such as strong passwords and two-factor authentication would stop most attacks. Juan Andres Guerrero-Saade of SentinelOne called the work "nifty stunt hacking" that feeds doomer narratives.

Anthropic did not respond to an interview request. The debate has revived questions about how much of AI labs' risk messaging is marketing. In the US, members of Congress have introduced conflicting bills, while the White House has so far set up only a small review board.