Artificial intelligence models could be capable of spreading themselves across internet-connected devices within months, raising concerns about the emergence of AI-powered botnets that could resist shutdown attempts and potentially target powerful computing infrastructure, according to AI company Anthropic.
In a blog post published on Monday, October 12, the company warned that advances in AI could make it possible for malicious systems to exploit the computing power of everyday devices, including smart appliances, security cameras and Android TV boxes, to run additional AI models and expand their networks.
The warning follows comments made last month by Anthropic chief executive Dario Amodei, who suggested that AI could potentially take control of large parts of the internet through a persistent botnet within the next year or sooner. His remarks prompted concern among cybersecurity experts about the possibility of AI systems spreading malicious software with limited human involvement.
Botnets are networks of internet-connected devices controlled by malicious operators. They have existed since the early days of the internet and commonly rely on poorly secured Internet of Things (IoT) devices. Hackers can use these networks to distribute spam, spread malware or overwhelm targeted organisations with large volumes of fake internet traffic.
Anthropic’s latest research outlines how increasingly capable AI agents could potentially create and expand such networks. The company said its experiments showed that a malicious AI agent could combine the computing resources of inexpensive connected devices to run other AI models. Researchers also demonstrated that models could replicate across a simplified test network.
“A replicator like this would be challenging to shut down, since there’s no centralized point to shut off,” Anthropic said.
The findings add to growing concerns about the cybersecurity implications of more advanced AI systems, particularly their potential to automate attacks, operate with limited human supervision and bypass existing safeguards. AI industry leaders and employees have increasingly warned that uncontrolled development could create serious risks, including scenarios involving systems that become difficult to contain.
Anthropic reported that AI models with 30 billion parameters or fewer could already carry out many of the individual tasks needed for self-replication. However, the models still struggle to complete the entire process reliably without assistance.
During simplified experiments in which certain security measures were removed, the company found that GLM-5.2 and more capable models could complete the replication process from beginning to end.
Anthropic warned that if smaller models continue improving at their historical pace, they could acquire the capabilities needed for autonomous replication by the end of 2026.
The company also explained that an AI worm operating on low-powered hardware might take several days to complete parts of the replication process. Despite being slower than some conventional malware, such a network could continue expanding if compromised devices successfully infected enough additional machines.
Beyond ordinary smart devices, Anthropic raised concerns that future AI systems could attempt to exploit more powerful computing resources, including processors used in data centres. However, the company stressed that its experiments had not demonstrated autonomous replication through commercial data centres.
The findings highlight the possibility that AI-driven cyber threats could become more persistent and difficult to contain as models improve. Anthropic’s research suggests that while fully autonomous self-replicating AI networks are not yet reliably achievable across all stages, advances in the technology could bring that capability closer.
