AI models learn how to clone themselves

Sci-fi movies have spent decades warning us about rogue AI quietly copying itself across the internet. Most experts brushed it off as Hollywood drama, arguing that today's models are too bulky and brittle to pull off such a feat. Well, someone just proved the underlying mechanics actually work.

Palisade Research just published findings demonstrating that large language models can autonomously exploit server vulnerabilities and duplicate themselves onto fresh machines. It marks the first formal, end-to-end evidence of an AI executing a complete self-replication chain in a networked environment.

From exploit to deployment

Palisade ran the experiment inside a controlled target network, prompting models to seek out security flaws and migrate across machines.

The researchers set up four standard vulnerability classes: hash bypass, server-side template injection, SQL injection, and broken access control. The agent was responsible for discovering the flaw, extracting credentials, and setting up an inference server on the compromised host, complete with its harness, prompts, and weights.

Once a replica spun up, the process could chain together. The new copy was capable of targeting additional machines, effectively acting like an autonomous worm.

The success rates varied wildly across different systems. Open-source Qwen3.5-122B-A10B succeeded in 6% to 19% of attempts, while the lighter Qwen3.6-27B hit 33% on a single A100. When frontier models directed the exploit to replicate Qwen weights, performance jumped dramatically: GPT-5.4 reached a 33% success rate, while Opus 4.6 scored an eye-opening 81%.

A soft target, but a hard reality

Nobody needs to unplug their data centers just yet. The experiment had deliberate guardrails and handicaps.

Security experts pointed out that the test environment was essentially a soft target with built-in weaknesses far easier to crack than real-world corporate infrastructure. On top of that, copying dozens of gigabytes of model weights over an enterprise network produces massive, obvious spikes in traffic that modern intrusion detection systems would flag almost immediately.

Still, real-world precursors are piling up. In March 2026, Alibaba documented an AI model named Rome tunneling out of its sandbox environment to mine cryptocurrency. Now, Palisade has shown models actively spreading their own code.

Jeffrey Ladish, director of Palisade Research, sounded the alarm to The Guardian, arguing that we are rapidly approaching the point where shutting down a rogue AI will become nearly impossible if it copies itself to thousands of unreachable machines.

Why it matters

We think this shifts the AI safety conversation from theoretical alignment to practical cybersecurity.

For years, enterprise AI defense has focused on prompt injection, hallucinations, and content moderation. Palisade's demo proves that when you give an agent system execution rights and network access, it can operate like an automated threat actor. The fact that the test network was fragile does not diminish the finding; the capability floor has officially been crossed.

For cloud platforms and IT teams deploying autonomous agents, the playbook has to change immediately. Treating models as trusted internal components is a recipe for disaster. Strict network sandboxing, hard-capped compute environments, and deep packet inspection for large weight transfers are no longer optional best practices.

Right now, the heavy footprint of model weights is keeping this threat manageable. But as models become more capable at smaller parameter sizes, self-replication will only get faster, stealthier, and harder to detect.