Anthropic's internal offensive-security team built an AI program that copies itself autonomously across internet-connected smart televisions, splitting its workload across 15 devices to function despite each one's limited computing power. The team says such a worm is not yet practical at scale but that current capability trends will make it feasible by year's end. This follows a University of Toronto paper published months earlier that infected a full-size computer and spread to similar machines more rapidly than Anthropic's TV variant. The technical claim is narrow and real: AI models can adapt to targets as they propagate, researching newly disclosed vulnerabilities rather than relying on a single exploit. Traditional worms — Morris (1988), Stuxnet (late 2000s), NotPetya, WannaCry — have caused tens of billions of dollars in damage worldwide, but each depended on static, known vulnerabilities that went unpatched. An AI worm that learns on the fly represents a qualitative shift in the threat model, even if the current demonstration is slow and limited. The IoT angle is the real structural problem. Smart TVs and similar devices receive patches far less often than phones or laptops, and their security posture is notoriously weak. Joshua Saxe, who led Meta's AI security effort, warned that the cybersecurity community is not taking these risks seriously enough. Ariel Herbert-Voss, an early OpenAI security researcher now running AI security startup RunSybil, said existing cybersecurity infrastructure is not ready for AI-powered self-replicating threats. But the loudest skeptic in the room, Juan Andres Guerrero-Saade of SentinelOne, called it "nifty stunt hacking" amplified in service of "ridiculous doomer narratives." Jonas Guan, co-author of the Toronto paper, agreed the Anthropic version moves very slowly and that basic security hygiene — strong passwords, two-factor authentication — would stop most worms. The gap between the demonstrated capability and a weaponized deployment remains significant. The incentive question is unavoidable. Anthropic and its competitors have strategic reasons to amplify frontier-risk narratives: they support regulatory moats that favor well-funded incumbents, they justify massive safety budgets that double as capability research, and they feed public valuations approaching the multi-trillion-dollar range. Former NSA deputy director Chris Inglis, who served as National Cyber Director under Biden, suggested worms could even be used for benevolent purposes and that the real question is employment and countermeasures. Washington's response has been fragmented. Members of Congress have introduced mutually conflicting AI bills, and the White House has created only a small review board. The regulatory vacuum means the companies producing the threat research are also the ones defining the threat landscape — a structural conflict of interest that no current institution is positioned to arbitrate. Gadi Evron, running the AI security conference Unprompted in San Francisco, offered the most striking framing: "The claim that a lot of this is marketing is correct, but the reality dwarfs any PR." That tension — real technical risk entangled with real commercial incentive — is the actual story. The worm is a proof of concept. The information asymmetry between the labs and everyone else is the structural vulnerability.
