When I visited my parents, my father told me he had read that AI would be able to clone itself onto smart devices to stay alive. I immediately called it gobbledygook. The idea of an AI escaping into people's televisions to avoid being shut down sounded like exactly the sort of story that gets passed around without anyone asking how it would work.
Hypothetically, you can spread a deployment across several computers, on a local network or even over the internet. I could see how that part might work. What I doubted was the rest: an AI finding suitable devices, copying itself onto them, and continuing without the machines that had supported it in the first place. I wanted to know how far the experiments had actually got, and how that had become a story about AI keeping itself alive.
I started with the news coverage. I do not know which article my father read, so I cannot trace the exact route the story took to reach him. But I could follow similar claims through headlines, public reactions, expert comments, and finally the research behind them.
On 13 October, TechRadar's headline described AI self-replication as “only months away”. Its opening paragraph used the more cautious “could become feasible”. Read only the headline and a possibility already sounds like something with a delivery date.
Tom's Hardware kept the practical limitation in its headline: “current deployment is impractical”. Its opening also described separate demonstrated components and the problems still standing between them and a working threat. So even at the headline level, the coverage was doing different things.
A Reddit post went with “unkillable” small models. It linked directly to Anthropic, so the claim did not need to pass through a newspaper to grow. The title still said “may”. Even so, being difficult to remove and being impossible to kill are very different promises.
This is a handful of examples, so it tells us little about what most people believe. It does show how the wording changes. In German we call the children's game Stille Post: a message passes from person to person until the last version barely resembles the first. Online, you can often follow the links back and see which qualifications disappeared along the way.
The expert comments were more varied than the picture of an approaching appliance uprising suggested. In Reuters' 13 October report, Ciaran Martin, the former head of Britain's National Cyber Security Centre, said the cheap-TV experiment “does not a security crisis make”. He saw exaggeration in how the vendor presented the work.
Jessica Ji, a senior research analyst at Georgetown's Center for Security and Emerging Technology, treated the scenario as worth considering while stressing the uncertainty: “it's not zero, but nor is it guaranteed.” Zhengxiong Li, an assistant professor at the University of Colorado Denver, was more concerned about the possibility of a distributed system with no single service to switch off. He also acknowledged the controlled test conditions. Those are different judgments about a possible threat, rather than a shared announcement that it has arrived.
These comments concern the actual work behind the headlines. That makes them more useful here than another famous person's general warning about AI escaping control.
The household scenario came from Anthropic itself. Its 12 October post by William Zhou and Daniel Freeman forecast that small models might soon replicate across consumer devices. Its conclusion also said: “We don't yet have a full rogue replicator.”
A few terms help make sense of the experiments. A model's weights are the numerical parameters it learned during training. Using them to generate output is called inference. A language model produces tokens, the pieces of text that make up its output. An agent connects the model to software that can act on that output, for example by running commands or moving files. That software is what lets the system do something to another computer.
In one experiment, Gemma4-26B-A4B ran across 15 purchased Android TV boxes with 4GB of memory each. It produced 0.39 tokens per second. That demonstrated that a model could run on those devices.
In a separate test, a GLM-5.2 controller running elsewhere deployed Llama3.1-8B across an eight-node emulated Android network. Access required no authentication, and researchers started subsequent controller instances after checking the deployment. The tested small models could not complete the full sequence. The methods describe these conditions, which matter a great deal to a claim about independent survival.
The distinction I care about is whether the new copy can keep working after the original system is switched off. Installing a smaller model elsewhere does not show that it can take over the installer's job. Can it find the next devices, deploy another copy, and repeat the process using only what it now has?
The end-of-year forecast came from extrapolating a general capability index. The authors acknowledged that this was only a proxy for replication ability. Improving at a range of tasks gives researchers a reason to test the next one. It does not show that a system can already finish a long sequence on its own. One failed installation, a crashed process, or an unresponsive device can stop the whole attempt.
Distributed models already work, including over connections much less impressive than a data centre's internal network. That part of the story is quite real.
Prima.cpp reports a quantized 70B model running over home Wi-Fi at 674 milliseconds per output token, about 1.48 tokens per second. Here, 70B means 70 billion parameters, and quantization stores them with fewer bits. The four-device setup included an M1 Mac, a laptop with an RTX 3070, a desktop with an RTX 2080 Ti, and a phone. The measured links provided 320–610 Mbps with 3–7 milliseconds of latency. That is useful evidence for a home cluster. The two substantial graphics processors are also rather important details.
Petals runs across the internet. Its published evaluation includes a 176B model spread over 14 graphics processors, at about 0.79 tokens per second in its sequential generation test. The system also handles finding servers and recovering from failures. We have measurements of this working.
Seventy billion parameters at four bits each still need about 35GB of memory, before the extra space required to run the model and hold a conversation. Dividing the model lets several computers share that burden. They then have to exchange data as the model runs. Training a new model is a separate and demanding task. Running an existing one slowly across borrowed hardware would not remove the need for large training facilities or fast inference services.
Model size alone does not settle what a system can do, either. I had been too quick to dismiss smaller models. The useful test is whether a particular model, with the tools and hardware available to it, can reliably complete the job.
There is also evidence for more complete replication. Palisade Research tested agents against deliberately vulnerable applications on provided GPU infrastructure. Its open-weight experiments included copying weights, starting a model server, and checking that the new model responded. Qwen3.6-27B produced a responding replica in 16 of 59 attempts, or 16 of 48 when refusals were excluded. That is a meaningful result under the supplied conditions. It does not describe a model finding enough ordinary household devices to support itself.
Another paper, AI Agents Enable Adaptive Computer Worms, illustrates why the setup matters. Its main propagation experiments used shared inference infrastructure outside the target machines. Deploying inference on GPU hosts was tested separately, with root credentials supplied to isolate that task. An agent spreading its software while asking a central server to think is already a security concern. It has a dependency that a claim of independent survival needs to account for.
A controlled experiment could answer this without a real outbreak in somebody's house. Give the agent a realistic starting point, describe its access and hardware, then remove the original inference service. Can the new copies keep doing useful work and repeat the process? How often does it fail? Those results would tell us much more than separate demonstrations of the individual steps.
The practical benefit is harder to see. Suppose an attacker already has a capable model on a powerful machine and can install ordinary software on compromised devices. Why move the model into a fragile collection of appliances? I would first compare that with leaving it on the powerful machine and sending commands to the devices.
A network of compromised devices under remote control is a botnet. Giving its controller a language model changes how it can choose actions. Where that model runs is a separate design choice. The distributed appliance proposal needs to explain the benefit of moving the computation as well.
There is a plausible advantage. Copies running locally might continue after a provider blocks an account or a central server is taken down. But they also have to cope with slower hardware, devices disappearing, incompatible systems, and the work of keeping everything connected. How much harder would the complete system actually be to stop?
Splitting one model across fifteen devices also gives you something quite different from fifteen complete copies. Each piece of a split model is called a shard. Lose a required shard and the system must replace it or recover elsewhere before it can continue. With complete copies, the others can carry on when one disappears. Petals shows that recovery is possible, but it takes working software. More devices alone do not make the system harder to stop.
Slow output could still be useful for a background task, even at a pace that would make a conversation unbearable. We would need to measure how much work gets done, how often the system stalls, and whether it finishes before the devices or network change around it.
An agent can also act to keep a task running without wanting to be alive. Ordinary malicious software is already built to persist. Describing those actions as survival can be useful shorthand, but it tells us nothing about whether a model experiences a wish to live.
The funny side of the story
I do find the picture funny. Millions of tiny language models in fridges, smoke detectors, and Roombas, mumbling to themselves forever. A world governed by lorem ipsum. There is something almost poetic about all those appliances endlessly producing the next sentence.
The imagined hardware is already generous: a smoke detector is hardly guaranteed to have the memory and computing power for a language model. And the text would have consequences if software used it to issue commands. Still, I enjoy the thought of a fridge contributing to the endless discussion while somebody waits for it to do something useful.
Take the fantasy further and the whole network becomes a self-sustaining, intelligent, energetic machine. By that I mean a collection whose parts keep feeding activity into one another until the whole seems to have a life of its own. The image reminds me of Félix Guattari's work with Gilles Deleuze in Anti-Oedipus: Capitalism and Schizophrenia (1972). Their account connects desire to social life and challenges psychiatric and psychoanalytic explanations that confine it to the individual and family.
Their machines include connections between bodies, institutions, work, and money. One process supplies a flow that another takes up or interrupts. Their discussion of the social machine, on page 141 of the English edition, describes people and their technical machines organised through institutions. The book also engages with anti-psychiatry, the movement that questioned psychiatric authority and the social conditions of distress, while criticising parts of it. Here, “energetic machine” is my own shorthand for that image of connected activity.
It is tempting to imagine all that activity eventually becoming conscious, as matter once gave rise to life. But endless text generation supplies no explanation of how consciousness would emerge. The comparison is interesting; it does not explain how the network would acquire a mind, or even how it would keep running.
I would still call the story my father brought home gobbledygook. The research I found does not show an AI escaping into household devices and keeping itself alive without outside help. It shows working parts of a possible system, tested under conditions that matter. Whether they can be combined into a useful independent system remains unproven.
I understand those parts better now. Distributed models work, and the replication experiments deserve attention. The claim that reached my father goes further. He should not need a lecture about model weights, network speed, and test infrastructure to find that out. The article he reads should say plainly what worked, what needed help, and what the researchers only expect might become possible.
That responsibility starts with the company announcing the research and continues with everyone retelling it. If the message reaching somebody at home is that AI will clone itself into the television to stay alive, the missing evidence needs to be explained there too.
This is the first of two companion essays. In AI everything: Why everything has AI now, I look at the other side of that same imagined future: why so many products are being sold as if AI belongs in all of them.