Anthropic has warned that small AI models could be only months away from gaining the capability to self-replicate across internet-connected devices such as smart appliances and low-cost Android-based hardware. While this is a warning about a potential near-term risk rather than a confirmed incident, it points to a cybersecurity scenario that European businesses should take seriously: AI-assisted malware spreading through poorly secured IoT environments without a central control point.

What happened

According to reporting cited by The Hacker News, Anthropic said smaller AI models may soon be capable of forming autonomous, self-propagating worm botnets on IoT devices such as smart ovens and off-brand Android TV boxes.

The key concern is not simply that AI could be used in cyberattacks, but that compact models running on or against low-cost connected devices could help malware spread independently from one device to another. Anthropic described such botnets as potentially difficult to shut down because there may be no single command server or central service to disable.

At this stage, the warning appears to describe a projected capability rather than a publicly confirmed attack campaign. That distinction matters for businesses: this is an emerging risk signal, not evidence that this type of AI botnet is already widespread.

Why it matters for European businesses

Many SMEs use internet-connected devices outside traditional IT oversight: smart TVs in meeting rooms, digital signage, printers, cameras, access systems, smart kitchen equipment, sensors and low-cost Android-based devices in retail or hospitality environments. These products often receive inconsistent security updates, use default credentials or sit on the same networks as business systems.

If AI-assisted malware makes IoT botnets more autonomous, attackers may be able to build resilient botnets faster and with less manual control. That could increase risks including:

• DDoS attacks launched from compromised business devices
• Network intrusion where insecure IoT hardware becomes an entry point into wider business systems
• Service disruption affecting retail, hospitality, logistics or office operations
• Higher incident response complexity if infected devices continue spreading malware without relying on a central controller

For European companies, this is especially relevant where cybersecurity obligations are increasing and where organisations are expected to manage technology risks across their digital environments, not only laptops and servers. Businesses in regulated or supply-chain-sensitive sectors may face greater scrutiny over weak device security, even when attacks originate through inexpensive third-party hardware.

Who may be affected

The risk is most relevant to organisations that use a large number of connected devices with limited security management. This may include:

• SMEs with mixed office, retail or warehouse networks
• E-commerce and retail businesses using smart displays, scanners, kiosks or connected stock systems
• Hospitality businesses operating smart TVs, building controls or guest-facing IoT devices
• IT teams and managed service providers responsible for customer environments containing low-cost connected hardware
• Industrial and regulated organisations where connected operational devices may create additional compliance or resilience concerns

Even companies that do not see themselves as heavy IoT users may have more exposure than expected through printers, cameras, meeting-room equipment, telematics, access control systems or smart appliances connected to corporate networks.

What companies should consider

Because the warning concerns a plausible near-term threat rather than a confirmed outbreak, the practical response is preparation. Businesses should review whether their current security approach covers connected devices beyond conventional endpoints.

• Inventory connected devices including TVs, cameras, printers, sensors, access systems and smart appliances
• Separate IoT from core business systems using network segmentation where possible
• Remove default passwords and apply unique credentials and stronger authentication controls
• Review update practices for low-cost and off-brand devices that may not receive reliable security patches
• Restrict unnecessary internet access for devices that do not need open connectivity
• Monitor unusual traffic that could indicate scanning, lateral movement or botnet behaviour
• Assess supplier risk when buying inexpensive connected hardware for offices, retail sites or operations

For businesses expanding their use of AI, this warning is also a reminder that AI security is not limited to chatbots and software tools. As smaller models become more capable, organisations may need to think about how AI changes the threat landscape for embedded systems, edge devices and unmanaged hardware.

For now, the most immediate business takeaway is straightforward: insecure IoT remains a practical attack surface, and advances in small AI models could make it more dangerous if companies do not improve visibility and control over connected devices.