Anthropic’s self-replication warning needs tests, not automatic acceptance

The report describes separate tests of different capabilities. In one, a 9B model set up inference—the process of running a model to generate outputs—on 8 of 9 tested hardware types. In another, GLM-5.2 completed a replication task in a simplified network, setting up Llama3.1-8B on new nodes.

Anthropic reported that GLM-5.2 reached all 8 nodes in 4 of 5 trials, and 7 of 8 in the remaining trial. But those nodes were emulated, and GLM-5.2 ran on a separate inference server because the nodes could not run the larger model. The test did not show one small model independently finding devices, gaining access and running itself across them.

A separate hardware demonstration also needs to be kept distinct. Anthropic ran Gemma4-26B-A4B across 15 Android TV boxes. That showed distributed inference across the boxes, not autonomous infection or spread from one device to another. Euronews’ report on Anthropic’s warning covers the forecast; the tests described in the report show pieces of a possible chain, not that chain operating in the wild.

A forecast is not a demonstrated threat

There is a serious case for taking the warning seriously. Anthropic reports that a model completed a multi-node replication task under test conditions, and that another model could run inference across a group of devices. If a future system could combine those abilities with access to vulnerable devices, it could pose a security problem beyond an AI service running in a data center.

Anthropic’s timing estimate depends partly on a trend in model capabilities. The company says small models could reach the capability level it associates with GLM-5.2 by the end of 2026 if they continue improving at their historical rate. Anthropic describes the index behind that projection as a proxy for replication ability and the timing as a rough estimate.

The company also says models with 30B parameters or fewer can complete many individual steps involved in replication but make errors when combining them into a full process. That is a reason to keep testing. It does not establish when—or whether—the entire task will work on real devices under realistic security conditions.

The strongest counterargument is that waiting for an incident would be irresponsible. That is right: security testing should not wait for harm. But precaution does not require treating a test of individual components as proof of the complete threat. Tom’s Hardware also described Anthropic’s work as demonstrating parts of a potential worm while noting practical limits involving model capabilities and target devices. The reporting around the warning does not establish an independent reproduction of Anthropic’s experiments.

The distinction cuts both ways. Calling the warning baseless would disregard the capabilities Anthropic says it tested. Calling its forecast a demonstrated event would go further than the evidence: the report does not establish that an AI worm is moving through smart homes or that a model can copy and run itself across consumer devices without assistance.

Require evidence for the whole chain

A credible assessment should test each link: whether a model can run on the target device, gain access under realistic security conditions, reproduce the necessary model files, propagate without human direction and persist after intervention. Success on one step should not be presented as proof of all the others.

Anthropic should make its assumptions and methods available for independent scrutiny, and other labs should try to reproduce the relevant tests. Evaluations should distinguish between a stronger model directing work from a server and a small model completing the process on devices it reaches. They should also measure how ordinary access controls affect results, since Anthropic says its emulated network made access easier than in real-world conditions.

That standard does not require certainty before anyone prepares. Device makers and security teams can consider potential abuse while researchers test the claim. But public warnings and policy responses should separate demonstrated results from forecasts and make clear what new evidence would change the assessment.

Anthropic has identified a risk worth investigating, not established an imminent, uncontrolled threat. Independent teams should now test whether the complete process works beyond simplified lab conditions; policymakers should base the urgency of any response on what those tests show.