Anthropic Warns Self-Replicating AI Botnets Could Be Months Away

Summary

Anthropic has published research arguing that self-replicating AI botnets could become feasible within months if smaller models continue improving. In the study, a 9-billion-parameter model set up inference on eight of nine tested hardware types, while a distributed Gemma4-26B-A4B instance ran across 15 generic Android streaming boxes at only 0.39 tokens per second. For the end-to-end replication test, Anthropic used Z.ai’s GLM-5.2 to copy Llama3.1-8B across eight Google Cloud instances running Android 15 emulators: it reached all eight nodes in four of five trials and seven in the remaining trial. The researchers say such a replicator could be difficult to stop because it would lack a single shutdown point and might adapt to unfamiliar devices. The experiments, however, did not demonstrate a worm breaking into ordinary systems. Anthropic largely omitted the exploitation step, used nodes deliberately built and left open for the project, and relied on a custom Memento harness; the company describes the result as an upper bound on real-world success. The article also notes that basic security hygiene could block common IoT entry routes without regard to whether AI is involved. Anthropic estimates that a future AI worm might take days to double in size, compared with roughly an hour for Mirai in 2016, and its large bandwidth demands could make infections easier to detect. Other open-weight models tested reportedly failed reliably, though Anthropic did not say how many were evaluated. The conclusion also assumes that GLM-5.2’s capabilities could be compressed into Llama3.1-8B and that small models will keep improving at their historical rate. Anthropic acknowledges that it does not know what autonomous replication would look like, or whether it will emerge at all.