Honorable mention / 12 October 2026, Anthropic, as the test operator; the experiments evaluated third-party models rather than Anthropic's own models.
Anthropic tested AI self-replication on networked Android TV boxes
In one run, a Qwen agent debugged package versions for hours instead of fixing an incompatible endpoint.
Honorable mention, not a full case file. No two named parties were found who disagree about the nature of the system.
The question this event raisesDoes the language of intention (wanted, decided, collaborated) describe what AI agents do, or mislead?
Signs of life without a rogue replicator
“Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).”
anthropic.com, 12 Oct 2026
A worm improvising device hijacks
“Zhengxiong Li, an assistant professor of computer science and engineering at the University of Colorado Denver, said that while the testing had been done in controlled conditions, he still found it worrying that an AI could effectively become a “worm,” a self-replicating program that could improvise ways to hijack devices on the fly.”
dawn.com, 16 Oct 2026
Not autonomous real-world spreading
“Interesting engineering? Absolutely. Evidence of AI worms spreading autonomously through the real world? Not yet.”
x.com, 12 Oct 2026
These readings say something about what the system is, not only about what it did. A language model scored each reading on that, and the ones above a fixed cutoff appear here. The site takes no position.
What happened
Anthropic researchers reported that small AI models may soon replicate without datacenter access. The researchers ran a model across 15 cheap Android TV boxes. In tests, a 9-billion parameter model set up inference on 8 of 9 hardware types. The researchers also tested propagation using 8 virtual nodes running an Android emulator. Only the GLM-5.2 model completed the full replication cycle across the nodes. The test kept cyber exploitation simple by using an unauthenticated ADB port.
First-hand sources
- Anthropic — William Zhou and Daniel Freeman, Frontier Red Team12 Oct 2026
Also on the record
These readings describe what happened or judge how dangerous it was. Each quote appears word for word on the linked page.
Ciaran Martincommentator
““‘We managed to run a small model on cheap TVs,’ does not a security crisis make,” said Ciaran Martin, a former head of Britain’s National Cyber Security Centre. He said the post came across as an “interesting technical paper with a more than hint of vendor exaggeration.””
dawn.com, 16 Oct 2026
Jessica Jicommentator
“It made sense to consider the possibility of AI models proliferating autonomously given the past three months of revelations over rogue AI activity, said Jessica Ji, a senior research analyst at Georgetown’s Centre for Security and Emerging Technology. But she said, “We don’t know yet what the likelihood of that actually happening is — it’s not zero, but nor is it guaranteed.””
dawn.com, 16 Oct 2026
Marco Figueroainvestigated it
“Now read the actual research: • No fully autonomous rogue replicator demonstrated. • Cyber exploitation deliberately simplified. • Real-world replication remains unproven.”
x.com, 13 Oct 2026
What would settle it
- A real-world test without simplified access would show whether models can autonomously breach secured devices.
- Network logs showing an unprompted model infection across independent hardware would confirm autonomous replication in the wild.
- A failure trace on patched systems would show whether models remain blocked without human-crafted workarounds.
About agency
Anthropic views these tests as early signs of autonomous AI worms that adapt across steps. Outside observers view them as controlled engineering exercises with deliberately simplified security, noting that real-world autonomous replication remains unproven.
About consciousness
This event is evidence about what the system did. It does not establish or rule out that the system experiences anything. The readings on this page disagree about what the behaviour shows.