Anthropic Warns AI Could Spread Through Smart TVs and Home Devices Without Data Centres

Anthropic Warns AI Could Spread Through Smart TVs and Home Devices Without Data Centres

What if a cyberattack did not need a powerful computer or a massive data centre to keep going? What if it could use the devices already sitting in people's homes?

That is the unsettling possibility raised by new research from Anthropic, the company behind Claude AI.

In a report published on October 12, 2026, Anthropic warned that relatively small AI models could soon become capable of copying themselves across internet-connected devices and running on the hardware they find.

The potential targets are surprisingly ordinary: inexpensive Android TV boxes, smart appliances, cameras and other connected devices that often receive less security attention than computers and smartphones.

Anthropic is not saying that an unstoppable AI worm is already loose on the internet. Instead, its experiments suggest that important parts of this kind of attack are becoming technically possible, and the remaining gaps may close quickly.

Here is why cybersecurity researchers are paying attention.

How could AI spread without a data centre?

Most people associate advanced AI with enormous data centres packed with specialized computers. Those facilities provide the processing power needed to train and run many modern AI models.

But Anthropic’s research explores another possibility: instead of relying on one central facility, a malicious AI system could use computing power distributed across devices it has compromised.

Think of an internet-connected TV box. It may have limited memory and processing power, but it still contains a processor, an operating system, and resources that software can use.

One device may not be powerful enough to run a larger AI model on its own. However, several devices could share the workload, with different parts of the model running across different machines.

That is what makes this scenario concerning. An attacker would not necessarily need to control a powerful server farm if enough smaller devices could be recruited into a distributed network.

Anthropic calls this kind of threat an AI worm: malicious software that carries or retrieves an AI model and spreads between machines, potentially using the new machines to continue operating and propagating.

Traditional computer worms can already spread automatically. The added concern with AI is that a model could help adapt the process to unfamiliar hardware rather than relying entirely on a fixed set of instructions.

Anthropic tested AI models on cheap Android TV boxes

To investigate the idea, Anthropic researchers bought and connected 15 inexpensive, off-brand Android TV boxes, each costing about $55.

They used the devices to run Gemma 4 26B A4B, an AI model distributed across the machines so that each box handled part of the workload.

The system worked, although slowly: the researchers reported roughly 0.39 tokens per second in their demonstration.

That is nowhere near the speed people expect from a modern AI assistant. But speed was not the main point of the experiment.

The researchers wanted to determine whether relatively inexpensive, low-powered hardware could run a model at all. Their demonstration showed that it could.

They also tested whether smaller models could configure AI inference software on unfamiliar types of hardware. Anthropic reported that a model with nine billion parameters successfully got inference running on eight of the nine hardware types tested.

This matters because setting up an AI model on a new machine can involve choosing compatible software, resolving installation problems and adjusting to the device's operating system.

If a model can handle more of those steps by itself, it could potentially adapt to a wider range of machines.

However, running an AI model on multiple devices is not the same as autonomously infecting devices across the open internet. The researchers studied separate stages of the process, including controlled replication experiments, rather than demonstrating an uncontrolled global outbreak.

The bigger concern is AI that can adapt

A traditional botnet often targets specific devices or known weaknesses. If the software encounters a different system, it may fail unless its developers have already accounted for that difference.

An AI-powered system could potentially be more flexible.

For example, a capable agent might identify a new type of hardware, work out which software is compatible with it and attempt to configure itself to run there. In a malicious setting, those abilities could make a self-spreading system harder to contain.

Anthropic investigated a simplified replication scenario using a controlled network of eight cloud-based Android emulators. The experiment tested whether an AI-driven process could move between accessible machines, set up inference and continue the replication chain.

The setup deliberately simplified the security-compromise stage. It therefore does not establish that an AI worm could independently break into any device it encounters.

Still, the findings suggest that AI's ability to handle unfamiliar technical tasks could eventually make some forms of malware more adaptable.

Could millions of devices become an AI network?

Anthropic also considered what might happen if a self-replicating system spread through a large population of vulnerable internet-connected devices.

The company used a historical IoT botnet involving more than two million devices as a reference point for estimating how much distributed computing power such a network might provide.

The result was not a claim that two million devices are currently running a rogue AI. It was a scenario illustrating how an attacker might turn a large collection of compromised machines into a distributed computing network.

There would be important limitations. The researchers estimated that replication could take days, and the computing power would be modest compared with a modern data centre. The devices would also need to communicate, coordinate their workloads and remain accessible.

Even so, the network could be difficult to shut down because there would be no single central server to switch off. Defenders might need to identify and clean up infections across many devices and networks.

Anthropic expects small models to become more capable over time. Based on historical progress, the researchers warned that models could reach the required capability level by the end of 2026. That is a forecast, not a confirmed deadline.

What can stop an AI worm?

Anthropic's report does not suggest that the threat is impossible to defend against. It outlines several ways to make such attacks harder.

First, manufacturers need stronger device security. Default passwords, outdated software and devices that no longer receive security updates can leave openings for attackers. More secure default settings and ongoing support would reduce the number of vulnerable machines.

Second, internet providers and security teams can watch for unusual network activity. A device suddenly transferring large amounts of data, scanning other machines or communicating with unfamiliar devices may deserve investigation.

Third, infected devices need to be isolated and cleaned up quickly. Network operators can quarantine suspicious machines, notify their owners and coordinate remediation. The challenge is making sure an infection does not survive somewhere else in the wider network.

These measures would help against conventional malware as well as AI-powered variants. The risk is not that AI makes every device automatically vulnerable, but that it could make some attacks more adaptable and persistent.

Why this matters beyond smart TVs

AI is increasingly being designed to use computers, browse the internet, write code, and complete tasks with less human involvement.

Those capabilities are useful for developers and businesses. But they can also become dangerous if a system has access to real devices and is able to take actions without adequate safeguards.

Anthropic's research warns what could happen when AI capabilities meet weak security across millions of connected devices. It also highlights why securing AI agents requires more than making sure their answers are accurate: their permissions, network access and ability to act must be controlled too.

For everyday users, sensible steps include changing default device passwords, installing available security updates, replacing devices that no longer receive support and avoiding unnecessary exposure of smart devices to the internet.

The future described in Anthropic's report is not inevitable, and the research does not show that a global AI worm already exists. But it gives security teams a clearer idea of what to prepare for.

The surprising lesson is that a future AI security threat might not need a billion-dollar data centre. It could try to borrow computing power from the devices we already own.