Artificial intelligence giant Anthropic has warned of a new cybersecurity threat to smart TV platforms, saying it has already seen evidence of “AI worms” that can self-replicate through insecure Android TV boxes.
In a blog post, the maker of the popular Claude chatbot said its latest experiments show that “small AI models may be just months away from being capable enough to self-replicate on commercial internet-of-things devices like smart ovens and off-brand Android TV boxes.”
The company said its tests involved cheap Android TV boxes from Chinese no-name brands that are already known for sometimes coming pre-loaded with malware and botnets that are used by cybercriminals to engage in malicious activities. Such boxes often run the open-source version of the Android TV platform, rather than the official licensed version from Google.
Anthropic said the risk of “Autonomous Replication and Adaptation” or ARA is very real. It likens the phenomenon to an “AI worm” that can spread malicious instructions without intervention by humans. In other words, it only has to be programmed once and let loose on unsuspecting users.
“A replicator like this would be challenging to shut down, since there’s no centralised point to shut off, though it may be slow (with a doubling time of days),” Anthropic wrote. “Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evaluations a 9B model got inference running on eight of the nine hardware types we tested.”
According to Anthriopic, AI models of 30 billion parameters and higher can already achieve ARA and start hijacking multiple devices autonomously. Examples of this include the open-source GLM-5.2 and more powerful models from companies including Google, OpenAI, Meta Platforms and SpaceXSI.
“If small models improve at their historical rate, they’ll match this capability level by the end of the year,” Anthropic said. “Small weight-based replicators may be possible soon after.”
Okay, so what does this all mean to consumers? Well, the reality is that if you have purchased and use a Chinese-made Android TV box, there’s a pretty good chance that you’re already part of an extensive botnet. And your device will likely be hijacked by an AI worm in the next few months, Anthropic says.
If you’ve invested in a more expensive, Google-certified TV device, the risk is much lower. That’s because those that run the open-source version of Android do not come with the same security protocols as official devices and TVs from reputable brands like Sony, Philips, TCL, Hisense and so on. Security is a key part of Google’s certification process, but note that even certified devices are no guarantee if you do things like sideloading third-party applications.
But why should you care about this? Well, running a botnet isn’t necessarily a disaster for your personal data. It doesn’t mean the hacker has access to your bank account and credit cards. But it’s disadvantageous, because one of the main side effects is that the botnet will be using your broadband connection to engage in malicious acts like scraping web data, launching spam campaigns and running ad-click fraud. This means less bandwidth for your own web activities, which means slower internet speeds that cause your streams and browsing to slow down.
If an ISP notices this activity, it could flag or even ban your IP address, which means you’ll find some websites and services are inaccessible, or you’ll run into frequent CAPTCHA prompts.
In addition, if the bad guys are really bad, they may try to use your device as a gateway to attack your home network and hack into other connected devices, such as your laptops, smartphones and other gadgets, potentially resulting in more serious problems such as stolen personal data.
The other issue is that this AI-controlled malware is often next-to-impossible to get rid of. In some cheaper Chinese set-top boxes, the malware comes hard-coded into the device, so even if you clear the cache or perform a factory reset, the malicious code will immediately restore itself once you reconnect to the internet.
Unfortunately, it seems that Android TV isn’t alone in being vulnerable to this kind of malware. While Samsung’s Tizen and LG’s webOS platforms are more closed, they also face problems with botnets and whatnot. A recent study by the cybersecurity firm Spur found that 42% of all apps it looked at on LG smart TVs contain malicious code that can result in devices being hijacked by botnets. Such botnets are also commonplace on Tizen-based apps, according to a separate study earlier this year.
LG and Samsung are both doing their best to clamp down on botnets, which take advantage of what's known as "resproxy code," but the reality is that they're engaged in a game of cat-and-mouse with cybercriminals and so it's unlikely they'll be able to permanently eliminate such threats.
That same study found that Apple’s tvOS is by far and away the most secure smart TV platform.
