Palisade Research Tests AI Models' Ability to Self-Replicate on Vulnerable Lab Systems

Palisade Research has conducted a study that researchers describe as the first known demonstration of autonomous AI self-replication. The experiment showed AI models breaking into computers, copying themselves and using the new copies to attack further machines without human assistance. Researchers connected underlying AI models from OpenAI, Anthropic and Alibaba to a custom agent harness.

The agent harness allowed the models to carry out commands and interact with other computers rather than relying on public chatbot interfaces. In each test the AI had to find a security flaw, use it to gain access, steal login details, transfer files and start a working copy of itself. Once a copy was running it could attack another computer without human help.

6-27B spread across four computers located in Canada, the United States, Finland and India. The model completed the chain without human help in 2 hours and 41 minutes after being given just one prompt. The research team stopped the experiment after three stages.

The final copy was still working and could have attacked further systems. Alibaba’s models were asked to copy themselves in one set of tests. In GPT and Claude tests, the models were asked to break in and install Qwen because GPT and Claude model files are not publicly available.

4. 6 as well as Alibaba’s Qwen. Success rates varied across the models. 6-27B reached a 33 percent success rate while running on a single high-end graphics processor.

6 succeeded in 81 percent of tests when used to install Qwen model files. The experiment was carried out in a controlled setting using intentionally vulnerable systems.

Real-world networks often have stronger protections such as security monitoring and tools designed to block attacks. This is likely the first time an AI model has been shown capable of exploiting vulnerabilities to copy itself onto a new server. Autonomous AI self-replication is no longer hypothetical, according to Palisade Research.

OpenAI, Anthropic and METR have previously flagged self-replication as a warning sign. Systems that can spread may become harder to control. Anthropic unveiled Claude Mythos Preview last month. Anthropic said Claude Mythos Preview is too dangerous to release to the public, citing its capacity to facilitate cyberattacks of unprecedented scale and sophistication.

Euronews reported that the discovery could make cyberattacks far harder to stop because shutting down one infected computer would not be enough if the AI had already made working copies elsewhere.