Artificial intelligence-powered malware could autonomously infect and spread across Internet of Things (IoT) devices, posing new security risks, according to a report from Anthropic released in October.

Traditional computer worms follow pre-programmed scripts to exploit known vulnerabilities. However, AI-enhanced worms could adapt to different devices and overcome security measures independently. Researchers demonstrated this capability by simulating eight Android devices in a controlled environment.

The test AI model installed itself on one device, replicated from there, and infected the remaining targets. In four out of five attempts, the model reached all eight devices; in the fifth attempt, it infected seven. Developers estimate such malware could learn to bypass security protections within one to two days.

Infected devices could be linked into a botnet network, accelerating propagation speed despite individual low processing power. The decentralized structure of this type of malware would make containment difficult. Anthropic compares the infection pattern to digital mold growing slowly over time.

Anthropic believes smaller AI models could achieve this level of dissemination capability as early as 2026. While connected devices can be disconnected from networks and security flaws corrected, the adaptive nature of AI worms presents unique challenges for cybersecurity defenses.