An AI that can replicate itself? According to Anthropic, it may only be months away

What if an artificial intelligence could copy itself, from one device to the next, with no human involved? That's the question studied by Anthropic's "Frontier Red Team," the group tasked with assessing the risks of AI models, in research published on October 12 (Anthropic). Its conclusion: small AI models could be capable of replicating themselves across consumer connected devices within a few months. The researchers stress, however, that no AI of this kind has been observed outside their experiments, and that several of their results represent a worst-case scenario.

1. What Anthropic tested

Until now, running an AI required powerful servers housed in data centers. The researchers wanted to know whether an AI could do without them by using cheap, poorly secured devices, such as off-brand Android TV boxes or smart ovens. They bought 15 boxes at roughly $55 each and managed to run an AI model (Gemma 4) split across all fifteen. The result is very slow, around 0.3 to 0.4 "tokens" per second (a token is a fragment of a word), but it works (Quartz).

They then tested full propagation in a closed network of eight simulated devices. The open-weight model GLM-5.2 managed to copy itself onto all eight devices in four out of five trials, and onto seven in the fifth. The other open-weight models tested failed. A smaller, 9-billion-parameter model managed to set itself up on 8 of the 9 hardware types tested, without being able to chain every step of the propagation on its own (The Next Web).

2. What does it mean for an AI to "replicate"?

The principle resembles that of a computer virus: a program finds a vulnerable device, copies itself onto it, then starts again from that new device. The difference, according to the researchers, is that a conventional virus is written for a specific type of device, whereas an AI could figure out a device it has never seen and adapt to it. In their tests, a model that passed notes to its successive copies saw its success rate rise from 45% in the first generation to 61 to 84% in later ones.

The authors point to another characteristic: such a program would be spread across thousands of devices, with no central server that could simply be switched off (CNBC). Its spread would, however, be slow, with the number of infected devices doubling over several days rather than minutes.

3. What's demonstrated, what's extrapolated

Demonstrated in the lab: an AI model can run on cheap consumer devices, and at least one open-weight model can spread on its own through a test network. Extrapolated: the timeline. The researchers observe that small models are improving at a steady pace, and estimate that at this rate they would reach GLM-5.2's level by the end of 2026. They themselves call this estimate "rough." Deliberately simplified: the break-in step. In the experiment, the devices left an access point open with no password, which makes propagation far easier than in most real-world situations. The authors therefore present their results as an upper bound, and write that they do "not yet" have a full autonomous replicator.

The scenario doesn't come out of nowhere, though. The Kimwolf botnet, a network of hijacked devices with no AI involved, has already infected more than two million devices worldwide, mostly poorly secured Android TV boxes (Krebs on Security, Hackread). That type of device, and that type of flaw, is the starting point of the study.

4. Ways to defend

A large part of the research is devoted to protection. Internet providers could spot unusual multi-gigabyte transfers between home devices, typical of an AI model being copied. Subscribers with an infected device could be quarantined and given cleanup instructions: against the Mirai botnet in 2016, this approach cleared 92% of infections within two weeks. Decoy devices could also be used to capture and analyze such a program. Finally, the authors call for shrinking the pool of vulnerable devices at the source, by requiring manufacturers to ship secure defaults, as the UK did by banning default passwords on connected devices. The goal is for any replicator to infect fewer than one new device per infected device, so that it eventually dies out on its own.

5. What everyone can do

These recommendations overlap with security advice that already applies today against conventional botnets: choose TV boxes and connected devices from manufacturers that publish updates, install those updates, change default passwords, and turn off "developer" or debugging modes when you're not using them. These steps reduce the number of exploitable devices, whatever kind of malicious program is involved.

The takeaway: according to Anthropic, small AI models could soon be able to copy themselves onto poorly secured connected devices, and one open-weight model already does so in a simplified test environment. No AI of this kind has been observed in the wild, and the timeline remains an estimate. Above all, the research highlights a concrete lever: the security of everyday connected devices, which governs the spread of today's viruses as much as that of any future programs.

Sources

• Anthropic : AI models may be capable of self-replicating without access to a datacenter
• CNBC : Anthropic warns AI models could self-replicate across home devices
• Quartz : Anthropic warned self-replicating AI on home devices could arrive within months
• The Next Web : Anthropic says small AI models may soon copy themselves onto smart devices
• Krebs on Security : Kimwolf Botnet Lurking in Corporate, Govt. Networks
• Hackread : Millions of Android Powered TVs and Streaming Devices Infected by Kimwolf Botnet