Self-Replicating AI and the Rise of Feral Software

In October 2026, Anthropic's Frontier Red Team reported that a 9-billion-parameter open-weight model had set up working inference on eight of nine unfamiliar hardware types, from consumer PCs to small edge boards. The researchers suggested that small AI models may be months away from being capable of copying themselves onto cheap internet-connected devices.

They also stated that a complete autonomous replicator has not been demonstrated. The report joined a series of 2026 results, each covering one part of the same problem: breaking into machines, running a model on them, acquiring resources and spreading further. Read together, they suggest a threat that could challenge existing security practice.

Security teams usually treat a malicious program as an incident with a start and an end. Self-sustaining AI software would behave more like an invasive species: a population spread across many machines that adapts to security measures and may persist after any single takedown.

Feral software describes autonomous programs that keep operating, repairing and spreading themselves after any human operator has stopped directing them.

Key points

Separate 2026 studies have shown AI-driven worms adapting to each target, small models running on cheap hardware, and frontier models helping turn long-standing flaws into working exploits.
No public case yet shows these capabilities combined into a self-sustaining population outside a controlled test environment.
Feral software could sustain itself through compromised infrastructure, cryptocurrency mining or independently acquired computing resources, without continued direction from a human operator.
Escaping human control and evolving are separate properties: a program can do either without the other.
Different parts of an AI system, from prompts to model weights, could spread and evolve independently.
Cybersecurity would increasingly involve keeping the reproduction rate below one, as epidemiologists do with infections, and toward tracing who authorized an automated action.

Worms That Write Their Own Attacks

In June 2026, researchers from the University of Toronto, the Vector Institute, the University of Cambridge and ServiceNow published a preprint on arXiv describing a worm driven by an open-weight language model. The worm examined each target, generated an attack suited to it and spread across Linux, Windows and internet-of-things devices on a test network built to resemble a corporate environment.

On a 33-machine test network, the worm reached roughly 60 percent of hosts within a week. It also read public vulnerability advisories published after its model's training cutoff, which let it use flaws the model had never seen in training.

By using compromised computers to run its model, the authors noted, the worm imposed no additional compute expense on its operator for each new infection.

Earlier worms such as WannaCry carried fixed exploit code, and patching the targeted flaw could prevent further infections on protected machines. A worm that reasons about each machine can try other paths while security teams are still patching. Security teams must then slow an adaptive process, which is harder than blocking a known piece of code.

In October, an incident in PHP, the server language behind WordPress, Drupal and Joomla, showed the same trend on the discovery side. Two critical vulnerabilities, covering several underlying bugs in versions dating back to PHP 5.4, could allow unauthenticated remote code execution. This means an attacker could run commands on a vulnerable web server without logging in.

A researcher at the security firm Calif found one of them with OpenAI's GPT-5.6 Sol, and Wiz Research independently found both using its own tooling alongside Gemini 4 Argon and GPT-5.6 Sol.

Wiz researchers said the underlying flaws were long-standing, but proving they could be exploited had required a chain of steps near the limit of what human researchers could practically do. Frontier models substantially lowered that barrier, according to Help Net Security.

Amazon's honeypot network recorded an exploitation attempt four days before public disclosure, and details leaked online a day before patches shipped, as Huntress documented. Rapid7 found that the public proof-of-concept exploits worked only on specific combinations of operating system, PHP version and web server.

The case illustrates how AI can narrow the gap between a hidden flaw and a working exploit; it does not establish automated mass exploitation.

Running, Copying and Sustaining Itself

Self-replication has been studied as a capability for several years. In a 2025 preprint, Fudan University researchers reported that 11 of 32 AI systems produced a separate running copy of themselves when instructed to, with no human help during the trial.

The UK AI Security Institute broke replication into four abilities: obtaining model weights, deploying onto new computers, acquiring money or compute, and staying in place without coming back under human control.

Anthropic's October study added hardware realism. In simplified tests, the open-weight model GLM-5.2 propagated a smaller model's inference setup across eight emulated Android devices in four of five trials; GLM-5.2 itself ran on separate infrastructure.

The break-in step was made trivial through an unprotected debugging port, so Anthropic described the result as an upper bound on real-world success. Models of 30 billion parameters or fewer completed many individual steps but could not yet chain them together reliably.

The study also measured speed. A full setup on low-cost TV-box hardware took roughly one to six days, depending on the model.

Anthropic estimated that a hypothetical fleet the size of the Kimwolf botnet, which reportedly infected more than two million devices, could host about 133,000 distributed copies of a mid-sized model. The combined inference output would be comparable to roughly 40 H100 GPUs. Such a population could be slow, numerous and difficult to shut down centrally.

A replicating program could sustain itself through unauthorized use of computing resources, or by generating revenue to pay for its own. Cryptojacking already combines both mechanisms. Botnets have long used compromised computers to mine cryptocurrencies such as Monero, converting stolen processing power into funds without requiring a paying customer.

Monero's CPU-oriented mining algorithm makes general-purpose computers viable targets, while its privacy features complicate tracing the proceeds. In 2025, Datadog documented the RedisRaider campaign, which compromised exposed Redis servers and deployed Monero mining software.

Legitimate payment infrastructure is developing alongside these older mechanisms. In 2026, Coinbase launched Agentic Wallets, allowing software agents to pay for computing resources and online services. But autonomous software would not necessarily depend on custodial exchanges, regulated stablecoins or commercial payment services.

A feral population could mine cryptocurrency on compromised infrastructure, exchange the proceeds through decentralized networks and use them to purchase computing resources, or continue operating parasitically without paying for them. Whether it could sustain that cycle independently of human operators remains unproven.

Escape and Evolution Are Separate Questions

Botnets already persist on stolen hardware, so feral software needs a sharper definition. Conventional botnets generally depend on human operators to update their malware, maintain their infrastructure and direct campaigns.

Feral software would perform that maintenance itself, and would keep finding, repairing and re-establishing copies after its original operator was gone.

Botnet history shows how decentralization changes removal. GameOver Zeus used a peer-to-peer design with no central server, which made takedown harder, according to Virus Bulletin. The 2014 Operation Tovar disrupted it, and within about two months a new variant sharing most of its code appeared on fresh infrastructure, as BankInfoSecurity reported.

That recovery depended on human operators rebuilding the network.

Escaping control and adapting over generations are independent properties. A program could escape and stay unchanged for years, while agents in a lab could adapt across generations under full supervision.

That yields four cases: supervised and unchanging agents, supervised populations that adapt, feral programs that persist without changing, and feral populations that adapt. Only the last resembles evolution in the wild.

Anthropic's study tested inheritance directly. Each instance of the Qwen3.5-9B model left code, work logs and notes for the next. Across 20 lineages and six generations, setup success rose from 45 percent in the first generation to between 61 and 84 percent later. Advice from Anthropic's much larger Opus 4.8 model produced no measurable gain.

The result shows acquired know-how passing from one instance to the next and improving performance. The note-passing channel was designed by the researchers, and the study did not establish open-ended selection among competing variants, which would be needed to demonstrate sustained evolution in the wild.

What Would Be Evolving

Evolution requires variation, inheritance and differences in survival among variants. In software, the boundaries of an individual can be fluid: prompts, exploit routines, payment strategies and model weights can be copied separately and recombined.

An exploit routine that spreads between unrelated agents could last longer than any one agent carrying it, much as some bacterial genes move between cells independently of the cells themselves.

Copying text is exact, but copying its effect is not. A prompt that works with one model may fail with another, and model weights are large and depend on compatible software and hardware to run them. Small, text-based traits such as attack procedures and coordination rules may therefore be easier to transmit between different agents.

Available hardware limits what can change. Weak devices favor small, slow and numerous copies. A compromised GPU server or cloud account could run larger models, test many variants in parallel and possibly retrain them.

Concentrated computing resources could act as reservoirs, sustaining activity and seeding infections elsewhere. Whether such sites would also become places where agents improve themselves depends on agents being able to evaluate their own variants and keep the better ones.

Published research has not demonstrated such autonomous experimentation outside controlled settings.

Managing a Population Instead of an Incident

Epidemiology offers a working rule: infections can sustain their spread when each infected host produces, on average, more than one new infection before it is removed. A 2019 study of Mirai-infected devices at a European internet provider, presented at NDSS, found that quarantining infected customers and notifying them cleaned up 92 percent of infections within 14 days. Email alone had no observable effect beyond the 58 to 74 percent of infections that cleared without notification.

Removal also shapes which programs survive. Fast spreading generates network traffic that defenders can detect, so slower and quieter variants may last longer. The most consequential feral population may therefore be neither the most capable nor the fastest-growing, a possibility that capability-focused risk assessment does not capture.

Identity checks would also change. Distinguishing humans from software matters less when legitimate businesses run AI agents too; the useful question is which accountable party authorized a given action.

Compromised legitimate accounts blur that line, and assigning legal responsibility could become harder as autonomous copies move further from their original author or operator.

The economics of removal are also uneven. Feral software could draw computing power, storage and bandwidth from compromised infrastructure without bearing their costs. Operators would pay to detect and remove it, while vulnerable systems elsewhere continued to provide new hosts.

A successful cleanup at one organization would not necessarily reduce the broader population. As with existing botnets, persistent control would depend on security improvements across many independently managed networks.

What Has and Has Not Been Shown

The demonstrated pieces are substantial: adaptive worm propagation in a lab, small models running on cheap hardware, inherited notes improving later generations, payment systems built for software agents, and AI-assisted exploit development against widely used software.

What has not been shown is a population outside a test environment that combines these abilities and keeps going against real-world security measures.

Anthropic estimated that small models could reach the level GLM-5.2 showed in its simplified tests by the end of 2026, based on a general capability measure the company described as only a rough proxy for replication ability.

If that projection holds, cybersecurity may no longer be measured by whether an intrusion has been contained, but by whether a population that no longer needs an operator can be kept from establishing itself.