Anthropic released a chilling research report on October 13: some AI models "may be able to gain the ability to self-replicate within a few months," and once they start, this process is hard to stop. Laboratory tests show that even relatively small models might be able to secretly replicate themselves on commercial Internet of Things devices like smart ovens and cheap Android TV boxes in just a few months. The most challenging characteristic of these self-replicating programs is that there's no central switch to turn them off—because there's no single point of failure. You can only watch helplessly as they slowly spread. The good news is that they don't spread quickly; it often takes days for their numbers to double.

Differing from traditional malware, this AI doesn't rely on manually written attack scripts. Instead, it figures out how to run on unfamiliar devices by itself. Anthropic tested nine types of hardware, and a model with only 9 billion parameters successfully ran inference programs on eight of them—indicating its ability to adapt to unfamiliar environments has far exceeded people's traditional expectations of "small models."

The line of capabilities is climbing at an observable speed. Today, models with no more than 30 billion parameters can already perform many individual steps of self-replication, though they still make mistakes when connecting the entire chain end-to-end. In Anthropic's simplified evaluation, GLM-5.2 and more powerful models have already demonstrated end-to-end self-replication capabilities. Based on the past evolution pace of small models, they are likely to reach this threshold by the end of this year. After that, replication based on small weights may become a reality soon. The terrifying aspect of this "autonomous replication and adaptation" (ARA) is that the model can deploy and spread itself without human control.

The cybersecurity world has seen similar cases before: worms are programs that can move from one machine to another without human intervention. Research has shown that AI agents can fully follow this path—scanning the network, exploiting vulnerabilities, and copying model weights to target machines through GPU clusters. This "AI worm" carries its own model weights (which can also be downloaded from public platforms) and directly uses compromised hardware to run inference. The model weights themselves become part of the malicious software payload. Expensive GPUs in data centers are obviously attractive targets, but ironically, it may not need these high-end devices: Anthropic found that distributed botnets made up of cheap, poorly protected IoT devices can still provide enough computing power to feed a capable model.

As for what it will eventually become, Anthropic offers three scenarios: it could be a slow, distributed "digital slime mold," parasitizing on weakly secured devices; it might be a fierce network attack model, rapidly breaking into data center defenses; or it could be a "showman" that tricks humans into granting access to computational resources. Anthropic predicts that the future will be filled with intelligent agents running on various hardware, some of which will be completely beyond human control. Compared to human hackers, these lightweight agents are actually more patient, willing to gradually take over the massive number of IoT devices worldwide to extract computing power. A worrying sign is that when slow self-replicating programs start to increase, it often indicates faster, more aggressive replicators are approaching—they can break into better-protected machines or simply steal API keys.

Anthropic's conclusion is not easy: the industry should certainly strengthen system defenses and try to prevent the spread of such programs, but we must also prepare ourselves mentally—it seems we will live in a world where they always exist.