‘These … clowns’: Why cyber researchers bristle at Anthropic’s ‘self-replicating code’ claims

Last week, Anthropic published a worrying headline on X and on its website: “AI models may be capable of self-replicating without access to a datacenter.” The company explained that it had used the computing power of 15 smart TVs to run an AI model. It also warned that other devices connected to the internet might be used to run large language models (LLMs). This upset cybersecurity experts.

“As a cybersecurity expert, the threats they’ve claimed are not based in fact,” hacker Anthony Jones told Straight Arrow.

For people who do not know much about self-replicating code, also called “computer worms,” the claim might sound scary. But cybersecurity experts and professionals who study computer worms were annoyed by the announcement.

They see it as another example of an AI company publishing something designed to grab headlines while ignoring how internet security really works.

The announcement certainly got attention. It led to a wave of worried news reports. The Guardian even asked whether there would soon be “AI in your oven?”

“These… clowns”

Juan Andrés Guerrero-Saade is an adjunct professor at Johns Hopkins University, a well-known hacking expert, and a distinguished fellow at the cybersecurity company SentinelOne. He expressed his anger in a long thread on X, where he shared the story with the caption “These f—ing clowns…”

He continued posting in the thread and even spoke directly with Anthropic employees. The exchange became heated.

“Pushing this specific unsubstantiated narrative to the detriment of the security industry appears to be a company effort,” he added in a later post.

When the relevant Anthropic team leader asked him to explain his comments, Guerrero-Saade replied: “It’s obvious to those of us established in this space that ‘cyber research’ is being used as a tool for policy arguments and regulatory capture.”

Jones, a cybersecurity researcher, told Straight Arrow that people should be careful about taking advice on cybersecurity from AI companies.

“It’s not their area of expertise, and neither is hacking,” he said. “That’s clear, from my perspective, when I read their research papers or their publications. They’re going into — delving into — a field they don’t really know or understand very well.”

Your fridge could already be a botnet

Computer “worms” have been around almost as long as computers themselves, Jones said. They have existed since the 1970s and have long been able to copy themselves onto any internet-connected computer or Internet of Things device, including cameras, bird feeders, and baby monitors.

That is a real risk, he said, but it is already well known. Devices with weak security can be linked together to form a botnet. A botnet can attack a website by sending so much traffic that the site becomes overwhelmed. This is called a distributed denial-of-service (DDoS) attack. Smart devices are useful for these attacks because they are often turned on all day and night. They are also easier to attack because there are billions of them, many use default passwords, and there are no rules governing the security of their code.

But, he added, AI companies are trying to reuse this old story to create a message “that only AI can protect you from what AI is doing.”

“Worms have been around for a long time,” Jones said. “All they are is self-replicating malware, so, malware that can go and infect something, and then from there reach out to other things and infect them.”

Worms can take over some of the memory in smart devices, such as fridges, toasters, or TVs, and use that memory to communicate over the internet.

Jones said adding AI would actually make a botnet worse and slower because AI uses more of a device’s memory.

“AI can’t run on a toaster,” he said, because “toasters don’t have enough memory.”

Fridges are a different matter, he said. Many people might not notice that their refrigerator had become part of a botnet.

“A fridge could already be a botnet — since fridges became smart fridges,” he said. “You would have no idea unless it used all the memory of the device.”

But, he added, “we’re really pretty good at shutting them down now.”

Worm history

“Worms actually used to be much, much worse,” Jones said. Better cybersecurity and greater awareness have made them less common. One of the best-known worms, the Mirai botnet, has been copying itself across the internet for 10 years.

The first federal conviction for creating a computer worm came in 1988. A graduate student at Cornell University released the “Morris Worm” “to see if it could be done.” The worm spread among devices connected to networks and slowed down almost 10% of the 60,000 computers that existed at the time. Robert Tappan Morris made the worm appear to come from MIT and designed it to spread secretly across the internet. He was also the first person convicted under the 1986 Computer Fraud and Abuse Act.

Maybe no signs of life

Jones pointed out that Anthropic’s research did not actually show evidence that a botnet had been created. The hardest part of building a botnet is finding devices that can be reached and attacked, he said, but the company did not do that.

“Once you’re on the devices, 90% of the work’s done,” he said. “In the research, they skipped that 90% entirely.”

“What they did was run a really slow and weak AI model on cheap TVs,” Jones said, because TVs are the only devices with enough memory to run a small LLM. “And then they somehow turned that into the headline of ‘self-replicating AI worms are coming.’”

In its post, Anthropic concluded that there were “signs of life” for self-replicating AI worms. That phrase may suggest more evidence than the research provides. Anthropic is currently involved in a high-profile debate about ideas and philosophy with Pope Leo XIV. The company wants him to agree that large language models could be conscious.

On Tuesday, Marcus Hutchins, a hacker best known for stopping the WannaCry computer worm attack, posted a list of other blog ideas for Anthropic in a slightly mocking tone. One idea described the risk of “an AI worm that poisons AI output, making people who use AI too much believe that they’re cybersecurity professionals.”