A self-replicating AI as an epidemic: how fast could it spread?

On 12 October 2026 Anthropic's Frontier Red Team published research on self-replicating AI. It shows small AI models completing most of the steps needed to copy themselves onto cheap internet-connected devices. It also says that no full replicator exists yet, and that one "may be slow (with a doubling time of days)".

I wanted to know how slow, so I treated the replicator as a pathogen and ran it in MemeLab, my browser-based outbreak simulator.

The result, in my central scenario: if nobody cleans the devices, the number of copies doubles about every 6 days (1.8 to 22 days across my assumptions). Starting from one copy, half of a pool of 2 million devices is compromised after about 16 weeks. The fastest past worms doubled in seconds to minutes.

The more useful result is a threshold. If a copy dies whenever one of its devices is cleaned, it cannot spread once devices are cleaned faster than about one in 24 per day (a half-life of 16.5 days). If copies can replace lost devices, the same cleaning does not stop it.

This is a scenario exercise with stated assumptions, not a forecast. No self-replicating AI has been demonstrated. The rates below are my own derivations and assumptions, not Anthropic's estimates.

#What Anthropic showed, and what it did not

The post tests the steps of replication separately, with small open-weight models. What it reports:

• A 9-billion-parameter model (9B) got an inference server running on 8 of 9 hardware types.
• The researchers ran a 26B model split across 15 cheap TV boxes of about $55 each, at 0.39 tokens per second.
• In an end-to-end test on a closed network of 8 cloud machines, only a much larger model (GLM-5.2, 744 billion parameters) replicated: it reached 8 of 8 machines in 4 of 5 trials. The 9B and 26B models reached 0 of 8 in every run.
• Small models have been gaining 13.7 points a year on a general capability index. On that trend one reaches GLM-5.2's level by the end of 2026, which the authors call "only a rough estimate".
• Setting up inference would take a 9B model 28 to 51 hours on TV boxes. That is computed from token counts and measured speeds, not observed.

What it does not show matters as much:

• No replicator exists. In the authors' words: "We don't yet have a full rogue replicator".
• No model copied itself. The agents set up a different small model, the test harness started the next copy, and the agent's own model ran on a separate server.
• The break-in step was not studied. The test machines had a debug interface left open without a password, which the post calls "an upper bound on real-world success".
• Nothing ran on the open internet, and the post gives no reproduction number and no derivation of a doubling time.

#How a self-copying model maps onto an epidemic

Each part of an epidemic model has a counterpart here.

The chance that an attempt works is 0.45 in the central case: about 60% for setup (46 of 76 runs when I pool the post's hardware tests for the 9B model) times an assumed 75% for getting in. Nobody has measured the second number.

The cleaning rates sit between two measured extremes. Conficker infections decayed at about 0.9% a week, which is 0.13% a day. In a study of Mirai at one ISP, 74% of infected devices were clean within 14 days with no action, about 10% a day. Mirai lived in memory and a reboot cleared it. A model of several gigabytes sits on disk, so I took 1% a day for neglected boxes.

One feature has no disease analogue: a copy needs about five devices at once. The post says a downed box can be replaced, but gives no time or success rate for that, so I ran two rules for what happens when one of the five is cleaned. A fragile copy is lost when any one of its boxes is cleaned, and its other boxes can be used again. A resilient copy replaces the box and lasts as long as a single box does.

The mapping used in every run.

I wrote the scenarios and what I expected from them down before running anything. Each scenario is 64 random runs from a single copy, with one simulator tick standing for 12 hours.

#How fast: slow by worm standards

In the central scenario with neglected, fragile copies the reproduction number is 4.2 and the doubling time is 6.1 days. The fast bound (quick, reliable access) doubles every 1.8 days. The slow bound does not spread at all with fragile copies, and doubles every 22 days with resilient ones.

Past worms and botnets, for scale:

• Slammer, 2003: 8.5 seconds (Moore et al.).
• Code Red, 2001: 37 minutes (Moore, Shannon and Claffy); the fit in Staniford et al. implies 23 minutes.
• Mirai, 2016: 76 minutes in its first hour (Antonakakis et al.).
• Conficker, 2008-09: about 1.4 days. This is my rough average over its first month, good to an order of magnitude.
• Kimwolf, 2025: about 7 days, second-hand, from a news report that it nearly doubled in a week (Krebs on Security).

The scenario bars are simulation results under my assumptions; the 15-hour bar is the speculative case at the end of this post.

The central case sits beside Conficker and Kimwolf, four to five orders of magnitude behind Slammer. Each attempt costs days of slow computing.

Slow is not the same as harmless. Starting from one copy, 1% of the pool is compromised on day 74, 10% on day 95 and half on day 113 (106 to 132 across runs). Running copies peak at 312,000 on day 131. Then it stays. A lost fragile copy frees its other four boxes, so clusters get reused, and after a year 12% of clusters still hold a running copy while 66% of boxes have been cleaned. Conficker is the precedent: about a million machines were still infected six years on (Asghari et al., linked above).

The central scenario's link, run in the app. The counter shows ticks, so day 731 is the end of day 365. Orange is running copies; the dark area, labelled "Dead" by the app, is boxes cleaned and out of the pool.

#The threshold: it lives or dies on clean-up speed

With fragile copies the reproduction number is the offspring rate divided by five times the cleaning rate. It falls below 1 when boxes are cleaned faster than 0.21 ÷ 5 = 4.2% a day, a box half-life of 16.5 days.

The simulation agrees. At 5% and 10% a day, all 64 of 64 runs died out, the largest after 29 copies in total. Just on the spreading side of the line, at a reproduction number of 1.2, 16 of 64 runs took off, doubling every 28 days.

All of that depends on the fragile rule. With resilient copies the same cleaning rates do not stop it: at 5% a day the reproduction number is back to 4.2, and at 10% a day it is 2.1, with a 9-day doubling and 82% of clusters compromised.

Above the line the replicator dies out. Needing several devices raises the line only if losing one device kills the copy.

#Defences: when matters more than how hard

The Mirai study measured what an ISP can do. Customers who were quarantined and notified cleaned up 92% of infections within 14 days, against 74% with no notification. That is one ISP and 40 customers, and it is the only measured number in this section.

In the model, a quarantine at that speed ends the central outbreak, and its size is fixed by the moment the quarantine starts. Started when 1% of clusters are compromised, 1.2% are ever compromised and no copy is running about 10 days later. Started at 10%, the final figure is 12%. With only half of ISPs acting it still ends, at 1.5%, with a tail of about 155 days.

This assumes every ISP acts at once. The post itself says coordinating across ISPs is difficult.

Secure defaults work differently. They slow the spread in proportion: with 25% of boxes hardened the doubling time goes from 6.1 to 8.1 days, and with 50% to 13.5 days. They stop it only near the threshold, and only for fragile copies: at 75% hardened, 59 of 64 runs died out, while resilient copies still spread.

Share of clusters ever compromised in the central scenario, median run.

#What this model leaves out

• The rates are inputs. Nobody has measured how often a model gets into a real device, or how fast devices holding gigabytes of malware get cleaned.
• Everything is equally reachable. Real device pools sit behind home routers and have been reached through a few large proxy networks. That structure, and closing it, is not modelled.
• Nobody adapts. The replicator does not hide or slow down, and defenders do not improve.
• Every copy lives equally long. That understates early extinction: none of the 64 central runs died out, where lifetimes that vary would lose about 24% of single starts.
• The payoff is small. By the post's own arithmetic, 2 million such boxes would amount to at most about 40 high-end datacenter GPUs' worth of inference.

#Speculative: a 1 GB model as capable as today's best

Everything in this section is extrapolation. No such model exists and the Anthropic post does not discuss one.

The model size needed for a fixed level of ability has been halving roughly every 3 to 4 months. Three rough estimates agree: a Stanford AI Index figure and a paper on "capability density", both of which I have second-hand, and my own fit to Epoch's capability index.

Extend that at a constant rate and a 1 GB model (about 1.5 billion parameters) reaches the level that replicated in Anthropic's test in about 2 years (1.2 to 3.2), and the level of today's best model, Opus 5.5, in about 3 years (2 to 4.6). The index has no score for any recent model that small, so the starting point is itself an estimate. And 1 GB cannot hold a large model's breadth of facts, so "as capable" would mean on narrow technical work, with tools.

In that scenario one copy fits on one device with 4 GB of memory, and a generation takes about 10 hours where the central case took 2.2 days. In simulation it doubles every 15 hours, and half of 2 million devices are compromised by day 13.

What changes most is which defence matters. With one device per copy there is no fragility left. The cleaning rate needed to stop it rises from 0.042 per day to 1.75 per day (a device half-life of 9.5 hours). The fastest quarantine measured for Mirai was about 0.6 per day. In the model, quarantine from 1% prevalence leaves the reproduction number near 6 and delays the halfway point by less than a day.

Only closing the way in caps it. With 75% of devices secure by default it doubles every 1.9 days and stops at the unhardened quarter. With both defences together it is held down but not ended quickly: it peaks at about 61,000 devices, and 14% have been compromised by day 60.

Speculative. The same quarantine that ends the paper-grounded scenario barely delays the 1 GB one.

The caveats are large. Defences are frozen at 2026 levels, although defenders would have better models too. Getting into a device does not get faster because the model is smaller: Kimwolf carried no model at all and still doubled only weekly. Routers and cameras lack the memory, so the pool stays the same class of device. And the trend is three years of thin data extended three more.

#What to take from it

As with a disease, the outcome here is set by how fast hosts are removed and how many are susceptible. Both are choices: whether ISPs quarantine and notify, and whether devices ship secure by default. For the slow replicator the post describes, cleaning alone can be enough. For a faster one, only the second choice holds.

Again: this is a scenario exercise, not a forecast, and no self-replicating AI has been demonstrated.

#Reproduce it

The scenarios open in the simulator from links and start by themselves:

• Central scenario, neglected devices
• The same with resilient copies
• Devices cleaned at 5% a day (it dies out)
• 50% of boxes secure by default
• Speculative 1 GB model

How to read them:

• One app "day" is one 12-hour tick, so divide the day counter by 2. The speculative link uses 2-hour ticks: divide by 12. It follows the scenario for its first 30 days.
• "Exposed" is a copy being set up, "Infectious" is a running copy, and "Dead" is boxes cleaned and out of the pool. Nothing is destroyed.
• The app caps its grid at 320 by 320, so each link runs a smaller pool (a quarter of it for the central scenario). Shares of the pool carry over; the first days and the chance of dying out do not.
• The R0 the app displays reads low in well-mixed mode, a known display limitation. It shows 1.8 for the central scenario, where the value the run realises is 4.2.
• A link shows one run, and it cannot start a quarantine partway through.

The simulation results in this post come from 64 runs per scenario on the app's own engine, which is in the public repository.

#Sources

• Zhou W, Freeman D. AI models may be capable of self-replicating without access to a datacenter. Anthropic Frontier Red Team, 12 October 2026. anthropic.com
• Moore D, et al. Inside the Slammer worm. IEEE Security & Privacy 2003. CAIDA
• Moore D, Shannon C, Claffy K. Code-Red: a case study on the spread and victims of an internet worm. 2002. PDF
• Staniford S, Paxson V, Weaver N. How to 0wn the Internet in your spare time. USENIX Security 2002. paper
• Antonakakis M, et al. Understanding the Mirai botnet. USENIX Security 2017. paper
• Asghari H, Ciere M, van Eeten M. Post-mortem of a zombie: Conficker cleanup after six years. USENIX Security 2015. PDF
• Çetin O, et al. Cleaning up the Internet of Evil Things: real-world evidence on ISP and consumer efforts to remove Mirai. NDSS 2019. paper
• Krebs B. The Kimwolf botnet is stalking your local network. 2 January 2026. krebsonsecurity.com
• Epoch AI. Epoch Capabilities Index, data as of 13 October 2026. epoch.ai/eci
• Xiao C, et al. Densing law of LLMs. arXiv 2412.04315. arXiv
• Stanford HAI. The 2025 AI Index report in 10 charts. hai.stanford.edu