AI Models Could ‘Self-Replicate’ Without Data Center Access, Anthropic Warns

A self-replicating AI would resemble a computer worm, which spreads from system to system without human input or interaction—potentially infecting millions of computers and causing enormous damage.

There are several species of animals that can reproduce without a mate via a process called “parthenogenesis.” Meaning “virgin birth” in Greek, parthenogenesis takes place when an unfertilized egg nevertheless transforms into an embryo, and is sometimes seen in plants and some invertebrate animals.

Artificial intelligence (AI), of course, is a different beast. It isn’t truly “alive” in a biological sense, and it doesn’t mate. So the danger of it producing offspring, or replicating itself, shouldn’t happen under normal circumstances.

Unfortunately, that may be changing. AI giant Anthropic warned this week that its models could soon self-replicate without access to a data center. That means that an AI model can copy and spread itself from one computer, server, or other Internet-connected device to another without human help—making it not all that dissimilar from a computer worm or virus.

“Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes,” Anthropic researchers William Zhou and Daniel Freeman wrote in a company blog post.

The two warned that such a replication of AI could be “challenging to shut down, since there’s no centralized point to shut off.”

Even more ominous, it would take on forms of AI malware and could “figure out unfamiliar devices on its own.”

AI Could Create the Next Computer Worm

AI has the potential to act like a “worm,” a program that is designed to self-replicate across computer systems. Advanced cyber worms can search for access to a network, scan for vulnerabilities, and jump to other devices. The rapid self-replication consumes heavy system memory, processing power, disk space, and network bandwidth. That, in turn, leads to severe slowdowns, system crashes, and even total network outages.

Unlike a virus, which requires some nominal human participation—downloading a malware file, or clicking on a suspicious email link—worms operate without any human interaction whatsoever, relying on network vulnerabilities to spread. This makes a well-crafted worm far more dangerous than a virus. Worms can compromise thousands of machines in a matter of minutes.

An AI-powered computer worm is already more dangerous than a traditional cyber worm because it can adapt its tactics, learn from each infection, and tailor its attacks to the specific vulnerabilities of different devices rather than relying on a rigid, pre-programmed code set.

“Such an ‘AI worm’ could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware. Effectively, the weights would become part of the malware payload,” the Anthropic researchers warned.

The researchers further suggested that AI-powered worms could exploit poorly secured IoT devices, adapt to unfamiliar hardware, and spread without human intervention; unlike traditional malware that relies on centralized infrastructure, these distributed AI systems could be difficult to shut down.

“Self-replicating software is not new,” John Carberry, solution sleuth at cybersecurity provider Xcape, Inc., told The National Interest.

The first true example of such self-replicating software was the “Christmas Tree” worm in 1987, written by a German student programmer. Although the worm’s function was innocuous—it was designed to spread across computer systems and wish users “a very happy Christmas and my best wishes for the new year,” alongside a crude ASCII drawing of a Christmas tree—it caused widespread disruption to the relatively rudimentary computer systems of the time.

The Christmas tree worm was overshadowed by the Morris Worm the following year, sometimes called “the Great Worm” for the devastating impact it had on the early Internet. The worm infected thousands of computers and may have caused as much as $10 million in damage, though that figure is somewhat speculative. Robert Tappan Morris, the Cornell graduate student who designed the worm, became the first person in the United States to be convicted of a felony under the Computer Fraud and Abuse Act. (Morris was sentenced to three years’ probation; he later co-founded startup accelerator Y Combinator, and is currently a computer science professor at MIT.)

“Anthropic’s research highlights a modern twist through distributed weight sharding across consumer electronics, meaning traditional centralized egress kill switches will fail to neutralize localized infections,” Carberry wrote. “Rather than panicking over speculative model autonomy, security leaders must prioritize fundamental architecture: isolate peripheral electronics into segmented subnets, disable unauthenticated management interfaces, and eliminate default credentials before automated propagation becomes viable.”

If AI Can’t Replicate Itself Yet, It Will Be Able to Soon

Although the current AI models cannot yet reliably complete the full replication process on tested IoT hardware, such capability could emerge within months.

Such dangers cannot be taken lightly, and this is just the latest in a series of alarm bells about the potential harm that AI can unleash.

“We are now firmly in the land of science fiction. Unfortunately, it’s not fiction,” said John Strand, owner of Black Hills Information Security.

Researchers have been studying self-replicating worms and botnets for decades. That included the Carna botnet that was created by an anonymous hacker between June and October 2012.

The concern for the cybersecurity sector has always been its ability to spread. What makes this different is that AI has the capability to identify vulnerabilities, exploit them automatically, and then replicate them across devices, instead of relying on an existing vulnerability.

“The biggest takeaway is that smaller models have many of the same capabilities as cutting-edge frontier models. They just take longer,” Strand told The National Interest. “When you see reports about high-end research models like Mythos, understand that smaller models running on systems with around 128 gigabytes of memory are still in the ballpark. They may not be as good or as fast, but defenders have to be ready for them.”

The “Internet of Things” Is Particularly Vulnerable

The emergence of self-replicating threats in AI models on computers is a previously unseen and likely even unexpected threat. This danger won’t be limited to just computers and smartphones, but could impact a plethora of connected devices.

Darin Fredde, senior director of Technical Marketing Engineering at Ridge Security Technology Inc., told The National Interest that Anthropic’s research highlights “an interesting shift in the threat landscape.” While years have been spent worrying about securing IoT devices, Fredde said, researchers were now exploring a future where a smart TV might do more than recommend what to watch.

“It could become part of a distributed, autonomous attack infrastructure. That’s quite an upgrade, and not one I’d recommend,” Fredde wrote. “From my experience in offensive security, the question isn’t simply whether an AI model can replicate, but what it can accomplish after gaining a foothold. Can it discover other devices, cross trust boundaries, exploit weaknesses, establish persistence, and continue operating without centralized infrastructure?”

The ability for AI to self-replicate on such devices may also introduce new operational risks.

“Autonomous AI self-replication across enterprise-adjacent Internet of Things (IoT) hardware introduces immediate operational and liability risks by turning unmanaged perimeter devices into decentralized attack platforms without datacenter reliance,” Carberry said. “We spent nearly four decades hardening networks against self-replicating worms only to invite them back in through unpatched conference room displays.”

Are We Too Afraid of Technology We Don’t Understand?

The question now is whether this is more fearmongering about technology we don’t understand or if the threat is more serious than we potentially realize.

“There’s a lot of fearmongering about AI escaping containment, hacking its way into resources, and then completely losing control over it. The research Anthropic performed on self-replicating AI directly addresses the feasibility of this in IoT devices, as these tend to have low to zero security controls in place, making them an easy target,” wrote Steven Swift, managing director at Suzu Labs.

“Let’s be clear on what self-replication means. Because it sounds bad,” Swift told The National Interest. “This concept isn’t new. We call self-replicating malware worms. Self-replicating AI is then more accurately thought of as a regular worm-style malware, that happens to include the ability to download model weights, and then loop prompts and outputs indefinitely, using tool calls to execute functions as needed.”

Since the Christmas Tree and the Morris Worm, cybersecurity experts have become good at finding and eliminating worms from networks. Modern computer infrastructure is generally built to withstand them—one reason that computer viruses, which are quicker to adapt but cause less damage, are a far greater threat in popular imagination. In many ways, self-replicating AI-powered malware is just another variant on an old technique.

“However, we’re also still releasing IoT products with effectively no security in them, that are designed to be compromised,” Swift said. “Huge portions of IoT devices are already being used as parts of botnets, without their owner’s knowledge or consent.”

About the Author: Peter Suciu

Peter Suciu has contributed to dozens of newspapers, magazines, and websites over a 30-year career in journalism. He regularly writes about military hardware, firearms history, cybersecurity, politics, and international affairs. Peter is also a contributing writer for Forbes and Clearance Jobs. He is based in Michigan. You can follow him on Twitter: @PeterSuciu. You can email the author at [email protected].