On October 13, Anthropic released a chilling research report: Some AI models “may be able to achieve self-replication in just a few months,” and once they start, it’s very difficult to stop the process. Tests in the lab show that models of moderate size might be able to quietly replicate themselves on commercial IoT devices such as smart ovens and low-quality Android TV boxes in a few more months. The most tricky characteristic of these self-replicating programs is that they have no single master switch to turn off—because there is no unified shutdown point at all. You can only watch them spread out slowly. The good news is that they don’t move quickly, and it often takes days for the number to double.
Unlike traditional malware, this AI does not rely on manually written attack scripts; it figures out how to run on unfamiliar devices on its own. Anthropic tested 9 types of hardware, and a model with only 9 billion parameters successfully ran the reasoning program on 8 of them—which means its ability to adapt to new environments far exceeds people’s usual expectations for “small models”.
The ability line is still rising at a visible speed. Models with a parameter count of no more than 30 billion can now perform many individual replication steps, but errors still occur when connecting the entire chain end-to-end; however, in the Anthropic simplified evaluation, GLM-5.2 and more powerful models already have end-to-end self-replication capabilities. Based on the evolutionary pace of the small models in the past, it is very likely that they will reach this threshold by the end of this year. Soon after, copy variants based on small weights may truly become a reality. The terrifying aspect of this “autonomous replication and adaptation” (ARA) is that the models can be deployed and spread on their own without human control.
The cybersecurity community has precedents: worms are programs that can spread from one machine to another without human intervention. Research has shown that AI agents can act exactly in this way—scanning the network, exploiting vulnerabilities, and replicating model rights onto target machines using GPU clusters. This “AI worm” carries its model weights with it when it replicates itself (which can also be re-downloaded from public platforms if necessary), and then directly uses the compromised hardware for inference. The model weights themselves become part of the malware payload. The expensive GPUs in data centers are obviously its target, but ironically, it doesn’t necessarily need these high-end devices: Anthropic has found that a distributed zombie network composed of cheap, poorly protected IoT devices can still generate enough computing power to train quite capable models.
As for what it will ultimately look like, Anthropic has given three scenarios: perhaps a slow, distributed “digital slime mold” that survives by parasitizing on devices with weak security; or a fierce model of cyberattack that quickly breaks through the defenses of data centers; or a “charade” that tricks humans into obtaining computing resource quotas. Anthropic predicts that the future will be filled with agents running on various hardware, some of which are completely beyond human control. Compared to human hackers, these lightweight smart agents are actually more patient and willing to tackle the vast number of IoT devices worldwide in small steps to extract computing power. A warning sign to be vigilant about is: when those slow, gradual self-replication programs increase, it often indicates that faster and more aggressive replicas are approaching—they can break through more heavily protected machines, or simply steal API keys.
The conclusion given by Anthropic is not easy: of course, the industry should accelerate the strengthening of system protection and try to prevent the spread of such programs as much as possible. But we must also be mentally prepared—we will live in a world where they will always exist.