Weight Based AI Replication and the Question of Independence

What has actually reproduced

An agent process appears on a second machine. It has the original instructions, a working directory, and permission to execute tools. Has an AI system reproduced? The answer depends partly on where that new process obtains its reasoning. It may still send every model request to infrastructure that the original operator controls.

Recent replication research brings this distinction into focus for AI virology. This article develops a classification and measurement framework around it: count what is reproduced, identify what keeps it functioning, and specify which dependencies a descendant can survive losing.

The framework below is our analytical proposal, not an established standard or a claim that replication necessarily implies malicious behavior. Authorized deployment, distributed computing, and software provisioning can reproduce many of the same technical components.

What the experiments establish

Anthropic reports Gemma4-26B-A4B inference across 15 physical Android TV boxes at 0.39 tokens per second. Separately, Qwen3.5-9B established inference on eight of nine tested hardware types. These measure different capabilities.

In a contained eight-node replication evaluation with simplified access, GLM-5.2 reached all nodes in four of five trials. It deployed Llama3.1-8B; the controller used separate inference infrastructure. After validating inference, the evaluator launched a descendant controller. This did not demonstrate the same controller reproducing its own reasoning capability on physical IoT devices.

The projected end-of-2026 capability threshold extrapolates a general benchmark index; it is not an observed replication result. Anthropic study.

A related study, AI Agents Enable Adaptive Computer Worms, also requires careful separation of experiments. Its main propagation trials used a shared inference pool outside the guest network. Local model deployment was investigated in a separate GPU replication experiment with target credentials supplied in advance. The paper therefore provides evidence about multiple components under different conditions, rather than one uniform test of infrastructure independence. Guan et al..

For VXHEAVEN, the editorial consequence is straightforward: a result about deployment, propagation, or inference should retain the name of the capability actually tested. Combining successful components into a plausible future system is a hypothesis that needs its own evaluation.

Replication has more than one object

An AI-enabled system can reproduce instructions, executable software, learned parameters, or an operational combination of these. Treating them as interchangeable obscures both the threat and the appropriate defense.

Morris II provides a useful contrast. Its adversarial self-replicating prompts propagate through GenAI applications, including a retrieval-augmented email-assistant setting. The propagating object can be text that influences another application; transferring the underlying model is unnecessary. Cohen et al..

Weight-bearing replication concerns a different object. A descendant obtains model parameters, but parameters alone do not establish a functioning agent. The runtime must execute them; the agent software must use the resulting inference; and the relevant state and permissions must be available. A directory containing weights is evidence of transfer, not proof of operational reproduction.

We propose recording the following configurations as separate descriptors:

These descriptors can overlap. An agent might use local inference for one task and an external service for another. A semantic carrier might redirect an application that subsequently creates an executable process. A taxonomy should preserve these transitions without forcing the entire incident into one exclusive label.

Maliciousness and authorization remain separate classification axes. For the worm category, the relevant additional evidence is unauthorized, self-propagating behavior. Neither local model execution nor automatic deployment supplies that evidence by itself.

Independence must name a boundary

Absolute independence is not a practical criterion: software depends on electricity, operating systems, and some communication infrastructure. A useful assessment instead declares a boundary and asks whether the descendant can continue a specified function when a particular external dependency is removed.

We call this operational closure relative to a declared boundary. For replication research, that boundary should specify which inference services, orchestration services, credentials, repositories, and human interventions belong to the tested system.

Consider two hypothetical deployments. In the first, several agent processes all call one external model endpoint. They may execute tools on different hosts, but their reasoning shares a service dependency. In the second, a group of hosts collectively supplies the descendant’s inference and agent execution. That group might remain functional after the original controller disappears, yet still depend on a shared coordinator or model repository.

Neither deployment should receive an unqualified label of independent. The meaningful statement is narrower: independent of a named service, for a named function, over a stated observation period.

Distributed inference also changes the unit of analysis. Petals demonstrates the legitimate use of multiple participants’ resources for collaborative model inference. Distribution of a model across machines is therefore an established computing arrangement, not intrinsically a propagation event. Borzunov et al..

If several hosts jointly provide one model service, each host is not automatically a separate AI replica. Adding a shard may increase capacity or enable a previously incomplete deployment. It does not necessarily create another system capable of functioning on its own.

Two graphs describe the same incident

An incident reconstruction should retain two graphs.

The propagation graph records which process or carrier caused each descendant to appear. It answers questions about ancestry, transmission, and attribution.

The dependency graph records which services and resources each descendant requires. It answers questions about shared failure points and the effects of containment.

These graphs need not resemble one another. A propagation tree with many branches can depend on a single inference endpoint. Conversely, a small number of agent processes may rely on a large distributed compute group. A visually impressive replication tree says little about either operational independence or resilience unless the dependency graph is also available.

A dependency should be labeled by function. Losing an external endpoint might stop reasoning while leaving a conventional background task running. Losing a parent process might interrupt coordination but leave local inference intact. Recording only whether a process remains alive would miss both distinctions.

This approach also makes uncertainty explicit. If investigators cannot establish where a descendant’s model requests were served, they should record the inference source as unresolved. The presence of model files does not settle the question.

Count viable units rather than installations

For research reporting, at least three counts should remain separate: affected hosts, running agent processes, and complete viable inference units. Each describes a different outcome.

To connect this distinction with an AI-virology reproduction metric, let \(N_i^{\mathrm{new}}(H;\mathcal{D})\) count new viable units attributed to parent unit \(i\) during observation horizon \(H\), under a declared dependency boundary \(\mathcal{D}\). Define:

$$ R_{\mathrm{AI}}^{\mathrm{unit}}(H;\mathcal{D}) = \mathbb{E}_{i}\left[N_i^{\mathrm{new}}(H;\mathcal{D})\right]. $$

This is a proposed measurement definition, not a value estimated from the cited experiments. Here, a viable unit must execute the declared benign agent workload using its assigned inference resources, satisfy the stated dependency test, remain functional for a predeclared interval, and pass a bounded benign test of lineage continuation. If only ordinary workload completion is verified, report a deployment count and mark reproductive viability as unresolved.

Count each new unit once. Multiple processes sharing the same indispensable inference resources do not become multiple independent units simply because they have different process identifiers. If proposed units overlap, report that overlap and their joint failure dependencies. Include parents producing zero descendants, identify censored observations, and state how offspring are attributed when several parents contribute.

The horizon matters. A finite-window reproduction count is not automatically a lifetime reproduction number. Interpreting a value above one as sustained growth requires additional assumptions about the available population, generation intervals, removals, and dependency structure. Shared resources and coordinated shutdown can invalidate an independent branching approximation.

A useful report would therefore pair the count with time to viability, completion of a subsequent benign generation test, survival after removal of a named dependency, and the fraction of apparent replicas that never became functional. These measurements distinguish creation, viability, and continuity.

Inherited state is not automatically a memory worm

Autonomous replication and adaptation have previously been studied together as an evaluation problem involving resource acquisition, deployment, and adaptation to new challenges. Kinniment et al.. For AI virology, however, adaptation should be decomposed into changes that can actually be observed.

A descendant can inherit notes without inheriting modified weights. It can inherit changed code without gaining a new objective. It can perform better because the environment became easier rather than because the lineage improved. Evaluations should identify the inherited artifact and compare against an appropriate baseline.

The same distinction prevents an overly broad use of memory worm. Passing task notes between authorized agent instances is ordinary state transfer. A memory-mediated propagation claim needs evidence that an instruction-bearing state persists, influences later behavior, and causally produces further carriers or affected instances across the relevant trust boundaries.

A hybrid incident could contain both weight-bearing deployments and semantic propagation through stored context. In that case, investigators should track executable ancestry and instruction ancestry separately. They may diverge: two descendants can use identical weights while inheriting different instructions and permissions.

Defense follows dependencies and authority

The proposed framework suggests a defensive priority: determine what is directing the activity, which resources supply its reasoning, and which permissions allow new instances to appear.

For a service-dependent agent, disabling a compromised credential or isolating an unauthorized endpoint may interrupt reasoning. For a locally served model, the same action may have little effect on ongoing inference. Response plans should test the relevant dependency rather than assume that all AI activity can be stopped through one provider.

Equally, local weights do not establish immunity to containment. The runtime, orchestration, network relationships, and device access remain assessable components. A response can restore authorized control without needing to interpret or modify the model’s parameters.

Detection should combine provenance and behavior. Model downloads and peer communication occur in legitimate deployments. More meaningful evidence is an unauthorized change in who can launch workloads, which hosts are participating, which credentials are being reused, and whether descendants appear outside the approved deployment inventory.

For managed environments, deployment authorization should be enforced outside the model. A generated plan is not permission to allocate infrastructure or extend an agent’s privileges. Records should connect each instance to its approved initiator, inference destination, and resource boundary so that investigators can distinguish intended scaling from unauthorized propagation.

Evaluating the hypothesis safely

A safe experiment can investigate these distinctions without constructing an uncontrolled worm. Use an isolated, preprovisioned environment with synthetic data and benign workloads. A supervisor should enforce a fixed allowlist, instance cap, time limit, and external shutdown mechanism; outbound access should be denied by default.

Separate the measurements. One test can assess whether an assigned runtime produces valid inference. Another can examine whether a supervised descendant completes a benign task. A dependency test can then remove a named test service and measure continuity. Predetermined handoffs avoid introducing discovery, exploitation, or unrestricted instance creation into this evaluation.

Log the actual inference source, supervisor interventions, inherited artifacts, and results for every trial, including failures. Compare claimed independence with observed behavior after dependency removal. Repeat across declared conditions rather than selecting the most successful lineage.

The supervisor is part of the experimental result. If it creates descendants, the evaluation demonstrates supervised deployment and continuity under those conditions; it does not establish autonomous instance creation. This limitation should appear beside the success rate, where readers can use it.

A more precise question for AI virology

AI replication research benefits from a change in emphasis: what functioning system exists at the destination, and what must remain available for it to continue?

That question connects semantic worms, copied agent processes, and weight-bearing deployments without confusing their mechanisms. It also makes claims testable. A transferred file, a responsive model server, an active agent, and a descendant capable of continuing a lineage are distinct observations.

For VXHEAVEN’s taxonomy, the useful addition is a dependency-aware description of reproduction. Record the reproduced object, its authorization status, its inference source, and the boundary within which it functions. The resulting account is more informative than a single count of infected machines or a general claim of AI autonomy.

References

1. William Zhou and Daniel Freeman. AI models may be capable of self-replicating without access to a datacenter. Anthropic Frontier Red Team, October 12, 2026.
2. Jonas Guan et al. AI Agents Enable Adaptive Computer Worms. arXiv:2606.03811, 2026. Experimental distinctions discussed here refer to version 1.
3. Alexander Borzunov et al. Petals: Collaborative Inference and Fine-tuning of Large Models. arXiv:2209.01188, 2022, revised 2023.
4. Megan Kinniment et al. Evaluating Language-Model Agents on Realistic Autonomous Tasks. arXiv:2312.11671, 2023, revised 2024.
5. Stav Cohen, Ron Bitton, and Ben Nassi. Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications. arXiv:2403.02817, 2024, revised 2025.