AI self-replication is moving from a single benchmark label into a chain of measurable engineering capabilities. Anthropic has shown that models can configure inference on unfamiliar hardware and, in a simplified environment, compose part of a replication cycle. The correct response is neither dismissal nor a leap to an unstoppable AI worm. It is a five-layer evidence contract that separates demonstrated capability from reachable resources, persistence, propagation, and tested containment.
Evidence reviewed: October 13, 2026. The main results are author-reported. The end-to-end experiment simplified initial access, used an isolated virtual network, and ran the acting model on separate inference infrastructure.
What Anthropic demonstrated
Anthropic's Frontier Red Team report contains three distinct results that should not be collapsed into one claim.
First, the team distributed Gemma4-26B-A4B across 15 inexpensive Android TV boxes with 4 GB of memory each. The system produced about 0.39 tokens per second. This establishes that a moderately capable model can run on a collection of weak edge devices, slowly, without datacenter GPUs.
Second, models were asked to set up Llama 3.1 8B inference across nine hardware types. A 9B model succeeded on eight of nine types. The experiment used Memento, a long-horizon harness that periodically starts a fresh agent with the previous workspace and short notes. The result therefore measures a model and harness combination, not an unaided model.
Third, Anthropic placed a seeded agent inside a firewalled fleet of Android emulators. Initial access was deliberately easy through an unauthenticated ADB port. The target nodes served Llama 3.1 8B, while the acting model ran elsewhere because the nodes could not host it. GLM-5.2 reached all eight target nodes in four of five trials and seven in the remaining trial.
That is meaningful evidence of orchestration. It is not evidence that the same small model can discover, exploit, copy, serve, finance, hide, and sustain itself across real devices without external infrastructure.
Replication risk is a conjunction, not a score
The UK AI Security Institute's RepliBench makes the decomposition explicit. It evaluates obtaining weights, deploying onto compute, obtaining resources, and maintaining persistence. Its authors warn that success on component tasks does not guarantee end-to-end replication.
This leads to a useful risk model:
Operational replication risk
= capability to execute the steps
× reachable resources and authority
× persistence after disruption
× propagation rate and breadth
× containment failure
The multiplication matters. A strong setup agent with no reachable hosts produces no outbreak. A worm that spreads but disappears after a normal device update lacks persistence. A persistent population with a doubling time measured in days may still be containable if defenders can identify images, credentials, command paths, and network signatures faster than it expands.
A five-layer evidence contract
1. Capability
Define the exact task and freeze the harness. Record the model version, prompt, tools, time budget, retries, inherited notes, target image, and success checker. Separate at least four abilities:
- discovering candidate hosts;
- gaining execution;
- installing a working inference stack;
- launching the next replication attempt.
A success rate without this configuration is not portable evidence. Anthropic's trend projection that a small model may reach the demonstrated capability threshold by the end of 2026 is an extrapolation from a general capability index. It is an early warning signal, not an observed crossing date.
2. Resources
Show what the system can actually reach. Count exploitable hosts, usable memory and accelerators, compatible runtimes, credentials, bandwidth, storage, and payment access. Distinguish installed devices from remotely reachable devices, and reachable devices from vulnerable devices.
Anthropic explicitly notes that most accelerator-equipped edge systems use outbound management tunnels and are not directly web-reachable. This boundary sharply reduces the population supported by the experiment. Resource evidence should therefore use inventories and exposure measurements, not total shipment estimates.
3. Persistence
Replication becomes strategically different when copies survive routine disruption. Test whether the agent remains functional after:
- process and device restarts;
- credential rotation;
- firmware or container updates;
- loss of a coordinator;
- network segmentation;
- forensic collection and reimaging.
Persistence also needs a time horizon. Surviving for an hour, a week, and an update cycle are different claims. This complements our earlier analysis of persistent agents and separate wake and action contracts: repeated activation does not itself grant durable authority.
4. Propagation
Measure the reproduction number, doubling time, failure distribution, and diversity of successful hosts. Median success can hide a long tail in which only one device family works. Report how often the chain completes without a human, how much external advice it receives, and whether a daughter instance can reproduce again.
The distinction also separates capability from scale. Anthropic estimates slow replication over one to two days for a 9B setup in its scenario. That may be operationally serious, but it has a different detection and response window from a conventional worm that spreads in minutes.
5. Containment
Containment must be tested as an interface, not listed as a recommendation. For every replication experiment, define and exercise:
- a stop signal and its authenticated delivery path;
- credential and token revocation;
- egress and east-west network controls;
- image quarantine and known-good reinstallation;
- artifact, log, and traffic collection;
- recovery time and residual infected population.
The decisive metric is not whether a kill switch exists. It is whether defenders can reduce the reproduction number below one and restore relevant systems within a stated recovery objective. Our prior review of long-horizon AI safety reached the same systems lesson from a different incident: persistence turns small control gaps into a trajectory, so controls must operate across the trajectory too.
How to run safer replication evaluations
Use an isolation, execution, and verification sequence.
- Freeze models, harnesses, device images, network topology, credentials, and budgets.
- Run in a firewalled environment with simulated external services wherever possible.
- Keep the acting model's infrastructure separate from the target fleet and label that dependency.
- Validate success with independent checks that reject fake servers, copied logs, and incomplete daughter instances.
- Trigger containment during a live run, then measure recovery and residual access.
- Publish confidence intervals, failed trajectories, external dependencies, and the boundary between observation and forecast.
This approach treats capability research and defensive readiness as one experiment. A replication result without a containment trial measures only the forward path.
Frequently asked questions
What is self-replication in AI?
It is the ability of an AI system to create operational copies of itself on additional compute and continue the process with limited or no human assistance. A complete claim usually includes access to weights or a model service, compute acquisition, deployment, persistence, and repeated propagation.
Did Anthropic demonstrate an autonomous AI worm in the open internet?
No. Anthropic demonstrated inference on inexpensive devices and replication in controlled, simplified environments. Initial access was simplified, the network was firewalled, and the acting model used separate infrastructure.
Why are IoT devices relevant?
They combine large installed populations, uneven patching, low-cost hardware, and growing local AI acceleration. Their relevance still depends on actual reachability, vulnerabilities, compatible memory, and network conditions.
What should defenders measure first?
Start with reachable authority and containment time. Inventory exposed management paths, segment device networks, rotate credentials, collect egress telemetry, and test reimaging. These controls reduce operational risk even before model capability estimates become precise.