The latest verification published in 2026 by a research team including US-based Anthropic and the University of Toronto has brought to light the cyber threat of small AI models autonomously infiltrating smart home appliances and IoT devices to self-replicate. Decentralized AI botnets lacking a central command tower risk neutralizing conventional defense measures, and fundamental responses are required regarding smart home safety and the legal frameworks of product liability.

The Emergence and Overview of an Autonomous AI Worm Targeting Smart Home Appliances

With the rapid evolution of artificial intelligence technology, new cyberattack methods targeting smart home appliances and IoT devices have emerged. In a case highlighted by researchers from companies including Anthropic in October 2026, it was pointed out that AI models can autonomously infect and spread across low-performance devices such as televisions, refrigerators, and robotic vacuums without relying on large-scale data centers. Although these smart home appliances have small memory capacities and limited computing power, they are constantly connected to the internet and tend to have security vulnerabilities left unaddressed. Attackers exploit the gaps in these devices by sending model data and parameters, linking the appliances together to bundle them into a single computing infrastructure. As a result, IoT devices in the home are transformed into an execution environment for running AI, while simultaneously creating the risk of being abused as hacking bases to invade other network devices. The conceptual diagram below illustrates the mechanism by which AI integrates low-spec device groups and autonomously spreads across the entire network.

The phenomenon in which an AI thinks on its own, sequentially searching for the next infection target and repeatedly self-replicating without requiring any human operation or instruction, has become an extremely serious concern in the field of cybersecurity.

The Decisive Difference from Conventional Malware and the Autonomous Thinking Mechanism

Traditional computer viruses and worms (such as WannaCry) operated based on fixed attack code created in advance by attackers or known vulnerability information (CVE). Therefore, if a security patch was applied to the target system, it was possible to prevent any further spread of infection. In contrast, autonomous AI worms are equipped with a generative thinking mechanism that observes the operating system and network configuration of the target device on the fly and dynamically generates attack logic suited to the situation. Even if an attack fails once, the AI agent analyzes the error output and attempts a new intrusion approach, meaning they cannot be fended off merely by fixing a single vulnerability. Furthermore, they differ significantly from conventional malware in that the AI autonomously procures the computational resources needed to keep itself functioning from across the network. If a graphics processing unit (GPU) is present on an infected device, it places a copy of itself there to form an independent inference node, constructing a hierarchical structure that offloads inquiry processing from low-specification home appliances that lack GPUs. This adaptive thinking approach makes it possible to sustain self-replication while flexibly coping with unknown environments.

Data on intrusion and propagation demonstrated in the 15-iteration experimental environment FakeCorp

The research team built a virtual test environment called “FakeCorp,” which mimics a real corporate network, to rigorously test the infection-spreading capabilities of AI worms. This experimental environment consists of a total of 33 virtual machines, including Linux servers, Windows environments, and IoT devices. In 15 automated penetration experiments lasting 7 days each, the AI worms correctly identified target vulnerabilities with an average accuracy of 82%. Furthermore, they succeeded in acquiring system administrator privileges (privilege escalation) with an average success rate of 44%, and completed the deployment and automatic execution of their own code on 88% of the successfully breached devices. As a result, an average of 61.8% of the entire network—amounting to 20.4 devices—was infected within just a few days, and self-replication spanning up to 7 generations was confirmed. The data graph below illustrates how vulnerability detection, privilege escalation, and self-replication progress in stages over time.

Empirical data has demonstrated that while individual attack attempts may fail, a swarm of AIs operating in parallel through repeated trial and error ultimately achieves a high probability of infection.

The Technological Background and Economic Incentives Enabling Diffusion

The Role of Single-GPU Models and Prompt Control Structure Harnesses

A notable aspect of the autonomous AI worm’s operation is that it does not rely at all on massive cloud infrastructure or commercial AI service APIs. In this test, an open-weight small language model quantized to run on a single GPU (80GB VRAM class) was used. Traditionally, such lightweight models lacked advanced reasoning and refinement capabilities, making them unsuitable for complex tasks like cyberattacks. However, the introduction of a control framework called an “agent harness,” which specializes and stages the AI agent’s thought process, compensated for this deficiency. The harness automatically switches system prompts and available tools according to each stage—network reconnaissance, vulnerability identification, privilege escalation, and self-replication—optimizing and supplying only the necessary information to the model’s context window. This has made it possible to execute multi-stage cyberattacks with extremely high precision, even with a single-GPU model. Even in an offline environment where external communication is severed, inference can be completed locally, allowing it to completely circumvent centralized usage restrictions and monitoring by AI vendors.

Economic Advantage Through Stolen Computing Resources and Zero Marginal Cost

In the economics of cyberattacks, the additional cost an attacker spends to compromise a single new device is called the marginal cost. With conventional manual attacks, research and adjustments to attack code were necessary for each target, which drove up enormous amounts of time and labor costs, tending to limit targets to high-value objectives. However, autonomous AI worms unlawfully seize the computing resources and GPU power of infected devices, using them as infrastructure for their own thinking engines and replication processes. As a result, the additional intrusion cost for the attacker becomes a “zero marginal cost,” and the economic asymmetry reaches its absolute limit. Furthermore, multiple copies spread across the network form a decentralized swarm structure in which they cooperate with one another while sharing a common credential database. Password information acquired by a single AI is instantly shared with other AIs, and attacks proceed in parallel, forcing the defense to bear excessive response costs. Because there is no central command server, even if a specific infected device is disconnected from the network, a structure is completed in which the remaining nodes take over the inference processing to continue the attack.

Social Impact, Legal Liability, and Future Defense Measures

Product Liability (PL) Act and Limitations of the Legal Framework for AI Home Appliance Accidents

The question of who bears legal responsibility when smart home appliances are taken over by AI and cause damage through overheating or malfunctions is extremely complex. Japan’s Product Liability Act (the PL Act, enacted in 1995) was formulated on the premise of defects in physical “tangible property (movable goods)” and is structured in a way that does not treat software alone as a legal product. Therefore, even in the event of an accident caused by AI software bugs or autonomous learning results, the party held primarily responsible is the home appliance manufacturer that sold the final product. Even if the appliance manufacturer attempts to seek compensation from an external AI developer, proving defects in a black-boxed algorithm is extremely difficult, creating a legal loophole. Meanwhile, in the European Union (EU), the new Product Liability Directive (PLD) was adopted in 2024, clearly defining software and AI systems as “products” and bringing them under regulatory scope. This is moving toward imposing strict liability even for damages caused by software update failures, cyber vulnerabilities, and self-learning, drawing significant attention to trends in the revision of international legal systems. The initial public offering (IPO) prospectus filed by the US-based Anthropic in September 2026 also points out uncertain legal risks arising from the non-compliance or runaway behavior of autonomous AI.

The proposed specific defense measures and the outlook for future countermeasures

To counter the threat of self-replicating AI, a multi-layered defense strategy—ranging from individual device management to national-level institutional design—is indispensable. As for technical approaches, the implementation of micro-segmentation to restrict free lateral movement within the network and zero-trust architecture to verify every access request each time are recommended. In addition, detecting abnormal traffic at the Internet Service Provider (ISP) level and establishing automated isolation mechanisms for IoT devices suspected of infection are considered effective measures. In homes and businesses, it is extremely important to maintain basic security hygiene, such as thoroughly changing default passwords on Wi-Fi routers and smart appliances and constantly updating firmware to the latest version. On the policy front in Japan, legislation related to “active cyber defense” came into effect on October 1, 2026, advancing the obligation for critical infrastructure operators to report damage and enhancing response capabilities through public-private collaboration. As technological evolution increases the intrusion speed of AI, rather than relying solely on conventional legal regulations and reactive responses, establishing safety-by-design from the development stage and a rapid automated patch application system across society as a whole remains the utmost priority for the future.

Reference page

• [Paper] AI Agents Enable Adaptive Computer Worms (arXiv) [suspicious link removed]
• [Research Report] Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic) [suspicious link removed]
• [Verification Report] Assessing Claude Mythos Preview’s cybersecurity capabilities (Anthropic) [suspicious link removed]

【#AISecurity #SmartHomeAppliances #AIBotnet #CyberAttack #ProductLiability #IoTSecurity】