Anthropic has warned that artificial intelligence models could be capable of replicating themselves across internet-connected devices within months, raising concerns that malicious AI systems could build persistent botnets, evade shutdown attempts, and potentially target data centers.

In a blog post published Monday, the AI company said its experiments demonstrated that malicious AI agents could combine the computing power of inexpensive connected devices to run other AI models. The systems also managed to replicate across a simplified test network, although reliable end-to-end replication remains a challenge.

Anthropic warned that such a network could be difficult to dismantle because it would lack a single central point of control.

AI-powered botnets pose emerging cybersecurity threat

Botnets are networks of compromised devices controlled by malicious operators. They commonly exploit poorly secured Internet of Things (IoT) devices, including smart appliances, Android TV boxes and security cameras, to distribute malware, send spam or overwhelm targeted services with fraudulent traffic.

Anthropic’s findings outline how AI could make such networks more autonomous, allowing malicious agents to use the computing resources of compromised devices to support further replication.

We're publishing our most detailed threat intelligence report to date. It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them. We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies. These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve. We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop. Read the report: https://t.co/0EJUnYEgfz

— Anthropic (@AnthropicAI) September 10, 2026

The company said models with 30 billion parameters or fewer can already perform many of the individual tasks needed for self-replication, even though they struggle to complete the entire process reliably.

During simplified tests in which certain security measures were removed, Anthropic found that GLM-5.2 and stronger models could achieve end-to-end replication.

If smaller models continue to improve at their historical pace, the company estimated that they could acquire the capabilities needed for autonomous replication by the end of 2026.

Anthropic warns of potential spread to data centers

An AI worm operating on low-powered hardware could take days to complete parts of the replication process, Anthropic said. However, the network could continue expanding if compromised devices successfully infected additional machines.

The company also warned that future systems could seek access to more powerful computing resources, including data-center processors, to accelerate their growth. Its experiments did not demonstrate autonomous replication through commercial data centers.

The findings add to growing concerns about the cybersecurity risks posed by increasingly capable AI systems, particularly their potential to automate attacks, operate with limited human supervision, and bypass safeguards.

Anthropic CEO Dario Amodei raised a related concern last month, suggesting that AI could potentially hijack the internet through a persistent botnet within a year or sooner. The warning prompted concern among cybersecurity specialists over the possibility of AI-driven malicious networks spreading at scale.

The latest research offers a more detailed account of how such a scenario might unfold, while underscoring the gap between demonstrating individual capabilities in controlled experiments and achieving reliable, autonomous replication in real-world systems.

Read more: Lancet warns leaders of extinction risks from nuclear conflict, AI