Artificial intelligence is changing how people work, communicate, and use technology. However, it is also creating new cybersecurity challenges. Experts are raising concerns about AI worms and the possibility of a major security incident. AI worms could use artificial intelligence to help cyber threats spread, adapt, or attack connected systems. These risks have increased calls for stronger AI safety measures and better cybersecurity protections.
The concern is not limited to large technology companies. Businesses, government departments, hospitals, and ordinary internet users could also face risks from poorly secured digital systems. The main challenge is to ensure that AI systems remain useful without giving attackers new ways to exploit computer networks. As AI tools become more connected and capable, security teams must prepare for threats that can move faster than traditional attacks.
What are AI Worms and why are experts Concerned?
An AI worm is a potential type of cyber threat that uses artificial intelligence to help copy, spread, or carry out harmful activities across connected devices. Traditional computer worms can spread between systems by exploiting security weaknesses. An AI-powered version could potentially use AI to identify weaknesses, adjust its actions, or make decisions with less human involvement.
For example, imagine a home with an internet-connected refrigerator, smart television, security camera, and mobile phone. If these devices contain security weaknesses, attackers could try to use one compromised device to reach others. Researchers are studying whether AI models could help automate parts of this process. However, this does not mean that fully autonomous AI worms already pose an unavoidable threat to every connected device. The concern is that future systems could make cyberattacks faster, more flexible, and harder to contain.
Why AI Worms are Raising Major Security fears
The latest concerns emerged during an AI industry summit in Dublin, Ireland, on October 14, 2026. Technology leaders warned that AI capabilities are advancing faster than the safeguards needed to control them. Google DeepMind chair Demis Hassabis described recent security incidents as early warning signs. He warned that future incidents could become more serious over the next few years without stronger action from companies and governments.
His warning highlights an important issue. Security teams must prepare for future risks before they cause widespread damage. Several factors explain why AI worms and other AI-driven cyber threats are receiving attention.
1. AI could make Cyberattacks faster
AI tools can help automate tasks that once required significant human effort. These tasks may include examining code, identifying software weaknesses, and analysing security information. Attackers could misuse these capabilities to speed up parts of a cyberattack. They might also use AI to adapt their methods when a target changes its security settings.
However, AI does not automatically make every attack successful. Attackers still face technical limits, security controls, and the need to access vulnerable systems. The main concern is the potential scale and speed of future attacks.
2. Connected devices could create more entry points
Modern homes and workplaces contain many internet-connected devices. These include routers, smart televisions, cameras, laptops, phones, and industrial equipment. Every poorly secured device can create another possible entry point for attackers. AI companies are also working to run more AI features directly on phones, laptops, cars, and household devices. This approach can improve speed and reduce dependence on remote data centres.
However, it can also create new security challenges. A compromised device could expose personal information or provide access to other systems if network protections are weak. This is why device security must improve alongside AI development.
3. AI Agents may act with less human supervision
AI agents are systems that can perform tasks, use digital tools, and complete multiple steps towards a goal. They can help users manage information, write code, and automate routine work. However, an agent with excessive permissions could also perform actions that its operator did not intend. The risk increases when an AI system can access files, communicate with other services, or make changes without approval. Developers must therefore limit what AI agents can access and do. Important actions should require suitable checks and human approval.
Why AI safety experts want stronger rules
AI safety is no longer only about preventing chatbots from producing harmful answers. It also involves controlling systems that can interact with software, devices, and online services. At the Dublin summit, Microsoft president Brad Smith called for urgent action to establish effective AI safety standards. He also supported safety controls and mandatory reporting of serious AI-related incidents. These proposals reflect growing concerns about the gap between AI capabilities and the systems designed to manage them.
Better testing before public release
AI models should undergo security testing before companies release them for widespread use. Researchers need to test how models behave when they encounter unexpected instructions, unsafe requests, or attempts to bypass restrictions. One proposed measure is to test new AI models inside offline sandboxes. A sandbox is an isolated environment that limits a system’s access to other computers, networks, and sensitive information.
If a model behaves unexpectedly, researchers can study the problem without exposing real systems to unnecessary risks. Testing should continue after release because new weaknesses can appear as software, tools, and user behaviour change.
Clear rules for AI companies
Companies developing advanced AI systems need clear security responsibilities. They should test their models, limit risky capabilities, protect user information, and respond quickly to reported vulnerabilities. Governments can support these efforts through proportionate regulations and common safety standards. Rules should also explain when companies must report serious incidents. This information can help other organisations identify similar weaknesses and improve their defences. Effective regulation should reduce risks without unnecessarily blocking useful AI research.
Emergency controls for AI Agents
AI agents should have reliable ways to stop when something goes wrong. These controls could include permission limits, emergency shutdown options, and restrictions on sensitive actions. For example, an AI agent managing company files should not be able to delete large amounts of data without suitable approval.
Similarly, an AI system should not receive unrestricted access to every device on a business network simply because one task requires limited access. The principle is simple: AI systems should only receive the access they need to perform their assigned tasks.
Could AI Worms spread through smart homes?
One of the most concerning possibilities involves AI systems running on everyday devices.
Anthropic has raised concerns about future AI models potentially copying themselves between connected devices. Research has examined how smaller AI models could be distributed across consumer hardware and how worm-like behaviour might develop. These findings highlight possible risks, but they do not prove that a fully autonomous AI worm can freely infect every smart device.
Consider a home with several smart devices connected to the same router. If an attacker compromises one device, weak network security might allow further attempts to reach other devices. AI could potentially help automate some of those attempts.
The possible consequences include:
- Unauthorised access to personal information.
- Disruption of smart home equipment.
- Attempts to steal account credentials.
- Misuse of connected cameras or other devices.
- Wider attacks against poorly protected networks.
These outcomes depend on the device, its security weaknesses, and the attacker’s capabilities. They are potential risks, not guaranteed consequences of using smart technology.
How people can protect their smart devices
Users can reduce these risks by following basic cybersecurity practices.
- Change default passwords on routers and smart devices.
- Install security updates as soon as practical.
- Use strong, unique passwords for online accounts.
- Enable two-factor authentication where available.
- Avoid installing software from unknown sources.
- Replace devices that no longer receive essential security updates.
- Keep sensitive devices on separate networks when possible.
These steps cannot prevent every attack. However, they can make it harder for attackers to exploit common weaknesses.
What could a major AI Security incident look like?
A major AI security incident could take several forms. Its impact would depend on the systems involved and the extent of the damage.
Attacks on Businesses
Companies often store customer information, financial records, and confidential documents on connected systems. An AI-assisted attack could help criminals identify weaknesses or automate parts of an intrusion. If attackers gain access, they might steal information, disrupt operations, or demand payment. Businesses can reduce these risks through regular security testing, access controls, secure backups, and incident response plans.
Risks to banks and financial services
Financial institutions depend on secure networks and reliable digital services. An attack could disrupt online banking, expose customer information, or affect internal operations. Automated attacks could also increase the workload for security teams. Banks need strong authentication, continuous monitoring, and clear procedures for responding to suspicious activity. Customers should never share passwords, PINs, or one-time verification codes with unknown callers or messages.
Threats to public services
Hospitals, government departments, electricity providers, and telecommunications companies rely on digital systems. A serious cyberattack could interrupt important services or delay essential work. AI-related risks become especially concerning when connected systems support critical infrastructure.
These organisations should test their defences, maintain secure backups, and prepare plans for operating during a digital emergency. For Pakistan, this is an important consideration as businesses and public services continue to adopt digital tools. Strong cybersecurity practices can help protect sensitive information and reduce service disruptions.
How AI Companies can balance innovation and safety
AI technology offers important benefits. It can help people learn, improve business productivity, support medical research, and automate repetitive tasks. The answer is not to stop developing AI. Instead, developers should make security a central part of the development process.
First, companies should evaluate the risks of each new capability. A system that only answers basic questions may require different protections from one that can access networks and execute commands. Second, developers should limit an AI agent’s permissions. Systems should not receive broad access when a smaller set of permissions is enough.
Third, companies should monitor real-world performance and investigate unexpected behaviour. They should also provide clear ways for users and security researchers to report problems. Finally, organisations should share important safety findings responsibly. Cooperation can help identify common threats before they spread across industries.
What happens next
The next few years will be important for AI security. Companies are developing more capable AI agents while expanding the number of devices and services that use them. This growth creates opportunities for innovation, but it also increases the need for careful security planning.
Governments may introduce new rules for testing, incident reporting, and the safe deployment of advanced AI systems. Technology companies will also need to improve their internal security practices. Researchers must continue testing how AI systems behave under unusual conditions. They should examine whether models can bypass restrictions, misuse digital tools, or interact with systems beyond their intended limits.
There is also a need for clear public communication. Reports about AI worms should explain what researchers have demonstrated and what remains a possible future threat. Fear alone will not improve cybersecurity. Evidence-based policies, reliable testing, and practical protections can make a meaningful difference. The central lesson is that security must develop alongside AI capabilities. Waiting until a major incident occurs could make prevention much harder.
Final thoughts
AI worms, fears of ‘major’ incident spur safety calls as technology leaders warn that security measures must keep pace with AI development. AI-powered systems could bring significant benefits, but weak safeguards may create new opportunities for cybercriminals. The risks deserve serious attention without unnecessary panic. Technology companies, governments, and users all have a role in improving cybersecurity. Better testing, responsible AI development, and stronger device protection can help reduce future threats. The priority should be clear: build useful AI systems while ensuring that security and human control remain essential.
Google DeepMind Chair Warns of Serious AI Safety Risks.
FAQ
Q. What are AI worms?
AI worms are potential cyber threats that use AI to help automate activities such as copying, spreading, or adapting attacks across connected systems.
Q. Why are experts worried about AI worms?
Experts fear that AI could help attackers move faster, exploit security weaknesses, and target more devices. These risks could increase if safeguards remain weak.
Q. Have AI worms already caused a major global incident?
The warnings focus on existing security concerns and possible future risks. They do not establish that a major global incident caused by a fully autonomous AI worm has occurred.
Q. How can people protect themselves from AI-related cyber threats?
People should update their devices, use strong passwords, enable two-factor authentication, avoid suspicious downloads, and secure their home networks.
Q. What safety measures are experts recommending for AI?
Experts support stronger security testing, isolated testing environments, limited system permissions, emergency controls, clear safety standards, and reporting of serious incidents.