AI Worms in Smart Homes: What Anthropic's Research Means

On October 12, 2026, Anthropic's Frontier Red Team published research on whether small AI models could eventually copy themselves across connected devices. Researchers ran one model distributed over 15 inexpensive, off-brand Android TV boxes they bought and networked together. That showed these devices could collectively run a capable model. It did not show a worm infecting ordinary households.

A separate replication experiment used a contained network of emulated Android devices with deliberately simplified initial access. GLM-5.2 completed the evaluated chain; smaller models could perform many individual steps but struggled to combine them reliably. Anthropic describes this simplified evaluation as an upper bound on real-world success.

The researchers project that small models might reach the needed capability by the end of 2026 if historical improvement continues. That is a rough forecast, not a deadline or proof of an outbreak. They explicitly say they do not yet have a full rogue replicator. Reporting on October 13 brought the findings to a wider audience.

An AI worm is self-copying malicious software that uses an AI model to help it operate or adapt. In the threat Anthropic studied, copies could run model weights on compromised hardware instead of depending entirely on a central AI service. Several low-powered devices could share the work.

The concern is adaptability: a model might work out how to run on unfamiliar hardware rather than follow a script for one device type. It would still need a way to gain access. Owning a smart TV, using an AI assistant or seeing a DNS request does not establish that a device is infected.

TV boxes, cameras, doorbells and other connected devices are computers that stay online with little attention from their owners. Weak default passwords, outdated software and unnecessary access can make them easier targets. Anthropic's demonstration concerns a particular class of off-brand TV boxes; it is not evidence that every smart TV or every brand has the same vulnerability.

These devices also communicate outside a web browser. A browser ad blocker does not filter a thermostat's own connections. A VPN can carry traffic for devices configured to use it, including through some routers, but encryption or a changed location does not inherently stop tracking domains. VPNs with additional filtering are a separate case.

Connected devices can send telemetry, advertising signals and usage information as part of their normal operation. In a 2017 settlement, the FTC alleged that VIZIO televisions collected viewing histories without informed consent. That historical example shows that smart-TV privacy concerns predate this AI-worm research; it does not describe every TV or establish current infection. Data collection is different from a malicious program taking over a device.

DNS activity can show which domains a device or service asks to contact. It does not reveal the contents of every connection, prove what information was sent, or establish who watched something. A domain label or blocked-request count is not an infection diagnosis.

Datante targets supported smart-TV and IoT tracking domains and displays household DNS activity. Where evidence supports it, activity can be grouped by a hardware family; those labels are not a physical-device inventory. Unclear activity stays grouped rather than being assigned an invented device identity.

Datante is a managed DNS-filtering layer. DNS translates a domain name into an address a device can use. When a lookup reaches your assigned Datante resolver, the configured rules can block selected tracking, advertising or harmful domains instead of returning their normal destination.

Configuring the router's DNS can extend that filtering to Wi-Fi and wired devices that actually use those settings, without installing a browser extension on each TV or appliance. Devices using another resolver, a VPN's DNS or cellular service are outside that router configuration.

Where malware filtering is enabled in your assigned profile, it can block lookups for classified malware domains. That may interrupt a malicious connection that depends on resolving a blocked name. It does not guarantee that an AI worm will be stopped, and Anthropic did not test Datante.

Review the protection levels in Datante Help before assuming every preset includes the same security rules. The dashboard offers household activity visibility and custom allow/block controls. If filtering breaks a needed service, review the affected domain and use the existing recovery controls rather than broadly allowing an unfamiliar destination.

DNS filtering is useful when a connection needs a domain lookup that reaches the filter and matches a blocking rule. It is not a packet-inspecting firewall, endpoint antivirus or firmware repair tool. Those distinctions matter for both ordinary malware and potential AI worms.

CISA's household guidance recommends unique passwords, updates, careful permissions and a separate network for connected devices. Start with those basics, then add DNS filtering as another layer: