Anthropic is warning that small artificial intelligence models may be only months away from gaining the ability to self-replicate across internet-of-things (IoT) devices, potentially creating autonomous, self-propagating worm botnets that would be extremely difficult to dismantle. The frontier AI lab shared the assessment in a report highlighted by The Hacker News.

The core concern

According to Anthropic, the risk stems from two converging trends. First, capable AI models are getting smaller and cheaper to run, meaning they can operate on constrained hardware rather than relying on massive cloud infrastructure. Second, the IoT landscape remains notoriously poorly secured, with countless devices such as smart ovens, off-brand Android TV boxes, and similar consumer gadgets shipped with weak or default credentials and infrequent patches.

Put those together, and you get a scenario in which a compact AI model could run directly on compromised or vulnerable devices, copy itself to new targets, and coordinate its behavior without a central command-and-control server. Anthropic reportedly warned that such a botnet would be "challenging to shut down" because "there's no centralized point to shut off."

Why decentralized botnets change the game

Traditional botnets typically depend on command-and-control (C2) infrastructure. Defenders can sinkhole domains, seize servers, or block traffic to cut the head off the snake. A self-propagating, AI-driven worm removes that choke point. Each infected device could act as an autonomous node, making decisions locally and spreading to new hosts on its own.

That architecture creates several headaches for incident responders:

  • No single kill switch. Takedowns that rely on disrupting C2 channels may have little effect.
  • Local decision-making. Infected devices could adapt their behavior, evade signature-based detection, and continue operating even if parts of the swarm are cleaned.
  • Scale and diversity. IoT devices are heterogeneous, often running stripped-down operating systems and firmware that security teams may not have visibility into.
  • Persistence. Many consumer devices are rarely rebooted, seldom updated, and difficult to monitor, giving malicious code a long dwell time.

The IoT attack surface problem

The warning lands against a backdrop of well-documented IoT security failures. Mirai and its many variants demonstrated how quickly internet-connected devices with default credentials can be conscripted into massive DDoS botnets. More recent research has shown that IoT malware continues to evolve, targeting routers, cameras, and set-top boxes at scale.

What is new in Anthropic's warning is the prospect of AI models themselves becoming the payload or the operator. Instead of hard-coded logic, a small model could potentially reason about its environment, identify new propagation paths, and modify its approach over time. Even modest capabilities in this direction could make automated defense significantly harder.

What defenders can do now

Anthropic's warning is not a prediction of an imminent attack, but it is a signal that organizations and consumers should treat IoT security as a forward-looking risk rather than a background nuisance. Practical steps include:

  1. Inventory and segment IoT devices. You cannot protect what you cannot see. Put consumer-grade and operational technology devices on separate network segments with strict egress controls.
  2. Eliminate default credentials. Change factory passwords, disable unnecessary services, and turn off remote management where it is not needed.
  3. Patch aggressively where possible. For devices that cannot be patched, plan for replacement or compensating controls.
  4. Monitor for anomalous behavior. Watch for unexpected outbound connections, unusual CPU or network activity, and devices attempting to scan internal networks.
  5. Prepare for decentralized incidents. Incident response playbooks should account for threats that lack a central server to take down.

A broader AI security conversation

Anthropic's warning also feeds into a wider debate about AI safety and security. As models become more capable and more widely deployed, the line between AI as a defensive tool and AI as an attack enabler continues to blur. Small models running at the edge could power useful automation, but the same properties that make them efficient — low cost, local execution, autonomy — also make them attractive for malicious use.

For security teams, the takeaway is not to panic but to prepare. The IoT estate has long been the soft underbelly of many networks. If AI-driven worms become practical, that underbelly could become the launchpad for attacks that are harder to contain than anything defenders have faced before.

Organizations should start by mapping their IoT exposure, hardening what they can, and building detection and response capabilities that assume the adversary may not have a single off switch. The window Anthropic describes may be short, but it is not closed.