In the living room, the robot vacuum cleaner moves around the room, lamps can be dimmed via voice assistants, and the heating is controlled using a smartphone, while the TV connects to the Internet to access streaming services. These applications represent examples of the "Internet of Things", where electrical devices connected to the network exchange data and communicate with each other.
As the latest market studies by industry association Bitkom show, around half of German households use these or similar smart home apps, and the trend is growing.
Artificial intelligence viruses in the vacuum robot?
But the artificial intelligence company Anthropic recently issued a report stating that malicious artificial intelligence programs may soon infiltrate networked home devices, automatically copy themselves to other devices, and then activate there again. Then there will be no need for expensive, high-performance supercomputers; perhaps several smart TVs or other networked home devices that lack adequate protection will suffice.
Computer viruses, also known as "worms," have been around for decades, and they follow a pre-programmed path. They exploit known vulnerabilities or poorly protected access points. But if these loopholes are blocked or suitable attack opportunities are not available, the worm will not be able to spread easily.
AI-based worms will be significantly more complex, and potentially more harmful: they will be able to solve problems independently and adapt to different devices. To achieve this, it would have to, for example, deal with a different operating system or limited RAM. It will also have to figure out for itself how to work on other devices, or how to recognize and bypass new security updates.
Spread through television
Researchers at Anthropic investigated whether AI models could also run on relatively low-cost hardware. In one experiment, they distributed an artificial intelligence model to 15 cheap Android TV boxes. Each device took over part of the calculations. In doing so, they showed that some AI applications can be run even without a huge data center.
In a controlled testing environment, the researchers created eight additional virtual Android devices. The AI model was able to infiltrate one of these devices and proliferate from there and infect other devices. In four out of five experiments, the model succeeded in reaching all eight goals, while in the remaining experiment it was able to reach seven out of eight goals.
If this artificial intelligence model is equipped with appropriate malware, it may be able to adapt relatively quickly to environments that were previously unknown to it, and cause disruption of processes and procedures in them. He may also learn how to circumvent various protection measures instead of just exploiting a specific vulnerability. According to Anthropic developers, this “artificial intelligence worm” may take approximately one to two days to install itself on a new device that you did not know about previously.
Botnets, or botnets, in home devices
The biggest problem is that artificial intelligence may be able to include various infected devices into a huge botnet. A single infected device has only limited computing capabilities, but the more devices are compromised, the faster the AI worm can spread. The malware will then no longer be dependent on a central server that can be easily disabled, as it will be able to operate and spread across the same network of infected devices.
Moreover, you may continue to learn continuously. It is quite possible that its impact will extend to completely different types of electrical devices that rely on very different software. While infected devices can be disconnected from the network and vulnerabilities can continue to be plugged, containing such AI-based malware will remain difficult due to its decentralized structure. Anthropic likens this potential scenario to a slow-growing digital gelatinous organism that gradually spreads over time.
It's true that the researchers at Anthropic designed access to the experimental devices to be very easy on purpose and without significant digital security measures. However, the company believes that smaller artificial intelligence models may reach the level of performance necessary for deployment in the real world as well during this year.
High temperatures in cooling systems
An incident in France shows how serious the consequences can be from a cyberattack targeting networked control systems. On the night after October 11, 2026, attackers tampered with the refrigeration and freezing systems of several supermarkets. Temperatures in the affected devices rose to about 50 degrees Celsius. Foodstuffs were destroyed, and fires and technical damage occurred in separate cases.
The French cybersecurity authority initially confirmed that several remote controls belonging to the Danish company Danfoss were infected. The warning was then expanded to include other manufacturers' systems. Investigations are still ongoing to determine the circumstances of the attack.
Modern supermarkets monitor and control their refrigeration systems via digital controls. Maintenance companies can access these systems remotely, for example to control temperatures. However, the security software was sometimes outdated and attackers may have exploited this as an entry point to launch their cyber attack.
A new dimension of cyber attacks?
It remains unclear who was behind the attacks in France and what specific motives led the perpetrators to do so. To date, no evidence has emerged of a self-replicating artificial intelligence worm being used in attacks on French cooling systems. However, recent research by Anthropic shows to what extent and with what serious consequences AI can facilitate the development of malware and thus enable attacks on networked devices even without the need for significant computing power.
For fear of further attacks, the French Cybersecurity Authority recommended that all companies update their networked devices regularly, and install the necessary security updates as soon as they are issued, while preferring to disable unnecessary Internet access capabilities.
Prepared in Arabic by: M.A.M
