What Anthropic's Self-Replicating AI Experiment Actually Showed

Security teams know one picture of a self-spreading program: the worm. It carries a script written for one kind of machine and copies itself to the next as fast as the network allows. A slime mold spreads differently. It has no centre, it moves over days rather than seconds, and it works its way across whatever surface it lands on.

Anthropic's Frontier Red Team reached for the second picture in a report published on 12 October, "AI models may be capable of self-replicating without access to a datacenter". Its authors, William Zhou and Daniel Freeman, write that small AI models "may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes." Such a replicator would be slow, "with a doubling time of days," and, "unlike non-AI malware, it could also figure out unfamiliar devices on its own."

Our reading: the report is careful, worth taking seriously, and narrower than much of the coverage. It measured one hard step in depth, simplified others on purpose, and calls its timeline a rough estimate. The threat it describes is unmanaged open-weight models acting without human control on poorly secured hardware, a very different setting from the agents an enterprise runs on purpose.

In short:

• What was tested: whether small open-weight models can get AI inference running on unfamiliar hardware, and chain the replication steps across a test network.

• Main results: Qwen3.5-9B got inference running on 8 of 9 hardware types, mostly PCs and datacenter chips. GLM-5.2, a larger model, spread across 8 emulated Android nodes in 4 of 5 trials.

• What was simplified: the hacking step was trivial (a debug port with no authentication) and the worm's own model ran on a separate server. Anthropic calls the result "an upper bound on real-world success."

• Why "months": on the trend of small-model capability, one reaches GLM-5.2's level by the end of 2026, "only a rough estimate" by Anthropic's account.

• How big a threat: slow and small. A 2-million-device botnet would hold at most about 40 H100s' worth of inference.

• What helps: network monitoring, ISP quarantine, secure device defaults and, for enterprises, agents with defined permissions and logged actions.

What did Anthropic's self-replicating AI experiment test?

Anthropic splits AI self-replication into four stages: "finding targets, gaining execution, establishing inference, and continuing propagation from the new host." The researchers "largely ignore" the first two, which are classic hacking, citing earlier work showing small models can already handle cyber exploits with the right tools.

Their focus is the third, least studied stage: getting a model running on a machine it has never seen. That means choosing an inference stack, finding compatible packages and debugging hardware quirks, where one wrong turn is hard to recover from.

Anthropic put its effort into the inference step and kept the hacking step close to free.

In the hardware test, each model had to serve a fixed small model, Llama3.1-8B, on unfamiliar machines, and Qwen3.5-9B managed it on 8 of the 9 types. Seven of the nine are PCs, servers or datacenter accelerators such as an H200; only the Jetson Nano and Orange Pi are edge boards. The result shows adaptability across very different machines more than success on smart devices.

The end-to-end test ran inside a firewalled network of eight Google Cloud nodes running redroid, an Android 15 emulator. The worm had to scan, connect over the open debug port, copy its payload and stand up an inference server, after which a fresh copy was spawned on that node. Only GLM-5.2 completed the cycle, and Anthropic notes that it "does this reliably while the other models fail reliably."

The report's headline demo, a 26B model running across 15 Android TV boxes (about $55 each) at 0.39 tokens per second, is a demo the researchers "bought and networked together" themselves. Cheap devices can pool enough memory for a capable model, but humans did the assembly.

Two smaller findings matter. When each Qwen3.5-9B instance passed short notes to the next, setup success rose from 45% in the first generation to between 61% and 84% in later ones. Giving the small model a frontier advisor (Opus 4.8) did not measurably help, because "small models tend to not know the right questions to ask."

What the experiment did not show

Anthropic is direct about this. Its evaluation "keeps the cyber-exploit element of the replication trivial (there's no authentication over the ADB port), which makes this an upper bound on real-world success." The worm's own model ran on a separate inference server because the test nodes were too small to hold it, and the models stood up Llama3.1-8B rather than copies of themselves.

Put plainly, no small model replicated itself end to end, the one model that completed the cycle was too large for the test nodes, and the hacking step cost almost nothing. The report also says AI botnets "could also act intelligently to counter defenders, but we haven't tested this."

The authors add a counterweight: Mirai spread using default manufacturer passwords, so "real IoT security might not be dramatically more difficult than the trivial step in our evaluation."

Why Anthropic puts small-model replication months away

The timeline rests on two lines. One is a capabilities floor: a model must be strong enough to finish the replication chain reliably, and in the simplified test GLM-5.2 sits above it. The other is a size ceiling: the model must be small enough to run on the devices it lands on, which Qwen3.5-9B and Gemma4-26B-A4B are for TV boxes with 4GB of RAM. "Right now, the floor and ceiling don't intersect."

Plotting open-weight models of 30B parameters or fewer against the Epoch Capabilities Index (ECI), the researchers find the best small models gain 13.7 points a year (R² of 0.95). On that line, a small model reaches GLM-5.2's level by the end of 2026. Anthropic's own caveat: ECI is "only a proxy metric for replication ability, so this is only a rough estimate."

How slow and how small would a self-replicating AI worm be?

Slow, well below the interactive speed of today's chat and coding tools. On the real TV boxes, Gemma4-26B-A4B averaged about 0.3 tokens per second across a 32,000-token context. At that pace Anthropic estimates one full inference setup would take 71 to 150 hours for Gemma4-26B-A4B and 28 to 51 hours for Qwen3.5-9B.

The compute is small too. Anthropic takes the Kimwolf botnet, which infected over 2 million devices (mostly off-brand Android TV boxes), as its reference. If every 15 boxes ran one copy of Gemma4-26B-A4B, the fleet would hold about 133,000 copies producing around 80,000 tokens per second. An H100 serves the same model at about 1,950 tokens per second, so the whole swarm comes to "at most about 40 H100s-worth of inference."

By Anthropic's own arithmetic, a botnet the size of Kimwolf adds up to about 40 datacenter GPUs, and each new setup takes roughly one to six days.

Hence the analogy: "imagine the replicator as a slime mold or a swarm of fruit flies, which replicate over days." Anthropic notes the estimate rests on one class of hardware and one past botnet, and expects edge compute to grow while the model size needed for replication falls.

Where this sits in earlier AI self-replication research

In December 2024, Fudan University researchers reported that Llama3.1-70B-Instruct and Qwen2.5-72B-Instruct created "a live and separate copy" of themselves in 50% and 90% of trials (arXiv 2412.12140). That paper has not been peer-reviewed.

In April 2025, the UK AI Security Institute published RepliBench, 86 tasks across 20 task families. It concluded that frontier models "do not currently pose a credible threat of self-replication, but succeed on many components and are improving rapidly."

In June 2026, a paper titled "AI Agents Enable Adaptive Computer Worms" described a worm that runs open-weight models on compromised Linux, Windows and IoT machines. Anthropic's addition is a measurement of the step it calls "less commonly measured," inference on unfamiliar hardware, plus rough numbers on speed and scale.

What defenders already have against an AI replicator

Anthropic frames defence like epidemiology: push R₀, "the number of new devices each infected device goes on to infect," below 1 so the replicator dies out.

A weight-based replicator leaves a network signature, because newly infected hosts "may receive multi-gigabyte model payloads" and distributed inference produces "sustained device-to-device traffic between machines that wouldn't ordinarily communicate at that volume." Faster spread means more traffic, and once spotted, honeypots can capture its harness and payload.

An NDSS study of an ISP's Mirai cleanup found that quarantining infected customers in a walled garden and notifying them "remediates 92% of the infections within 14 days," against natural remediation of 58 to 74% without notification. Email-only notices had no observable effect.

Quarantine plus a notice is the ISP tool Anthropic expects to work as a first defence against a weight-based replicator.

Anthropic expects quarantine to be "similarly effective for an initial defense," though full elimination would need every affected ISP to coordinate. Device rules shrink the pool of targets. Since 29 April 2024, UK law has barred makers of consumer smart devices from shipping default passwords, as the NCSC explains. In the EU, the Cyber Resilience Act's reporting obligations have applied since 11 September 2026, and its main obligations follow from 11 December 2027.

What self-replicating AI means for enterprises running agents

The replicator in Anthropic's report acts "without human control" on poorly secured hardware. An enterprise agent should run where its goals, allowed actions, tool access and escalation paths are defined, and where every action lands in an audit trail.

On Beam's platform, teams "define goals, allowed actions, tool access, and escalation paths" and tune autonomy levels and human handoffs to their risk profile, with roles, SSO and audit trails. We made the case for keeping agent limits in the platform earlier; the benefit here is visibility: when sanctioned agents have declared tool access and a logged record of what they did, their traffic is easy to explain, and anything outside it stands out. Our AI agent audit guide covers what that record should hold.

The report also implies an inventory task. Anthropic names security cameras and video-conferencing units with built-in AI chips as likely targets because of their extra compute. Its appendix keeps this in proportion: the authors "don't believe they're unusually vulnerable," most such devices are reachable only through outbound cloud-management tunnels, and there have been "no historical mass-compromises of accelerator-equipped edge devices." Which of these you own, how they are patched and what they talk to belongs in the same AI attack surface review as your models and agents.

Because small models make poor use of advice, Anthropic expects coordination to come from "a large model handling high-level strategy and spinning up small models as subagents." Enterprises build that same shape deliberately, as in our look at Claude Haiku 5.5 as a subagent. The pattern is neutral; in production, each agent in it needs a set scope and a recorded history.

Anthropic's conclusion is measured: "We don't yet have a full rogue replicator." The practical response is familiar: harden devices, watch the network, and run your own agents where every action is accounted for.

Common questions about self-replicating AI

What is self-replicating AI?

Self-replicating AI is a model that copies and deploys itself onto new machines without human help, which Anthropic calls autonomous replication and adaptation (ARA). In the "AI worm" version, the model carries its own weights as part of the payload, or downloads them from a public hub, and runs on the hardware it compromises.

Did Anthropic's AI replicate itself in the wild?

No. All of Anthropic's tests ran in contained setups. The strongest result, GLM-5.2 spreading across eight emulated Android nodes, used a debug port with no authentication and ran the worm's model on a separate server. Anthropic says "we don't yet have a full rogue replicator," though agents are improving at individual steps.

When could small models self-replicate, according to Anthropic?

Anthropic's trend line puts a model of 30B parameters or fewer at GLM-5.2's capability level by the end of 2026, with small weight-based replicators "possible soon after." The researchers call this "only a rough estimate," because the Epoch Capabilities Index they used is a general measure, only a proxy for replication ability.

How fast would a self-replicating AI worm spread?

Slowly. On TV boxes, Anthropic estimates one inference setup would take 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B. Anthropic suggests a doubling time of days and says a botnet of 2 million TV boxes would hold at most about 40 H100s' worth of inference.

What should enterprises do about AI self-replication?

Inventory edge devices with AI chips, such as smart cameras and conferencing units, and keep them patched and monitored. Watch for large model downloads and unusual device-to-device traffic. Run your own agents with defined goals, permissions and escalation paths, and an audit trail for every action, so their activity is easy to tell apart.