Self-Sustaining AI Worms: The Boundaries of Operational Independence

Independence requires a boundary

An AI-driven worm continues after its operator disconnects. Its agent processes remain active, its model requests succeed, and it produces descendants. This establishes a form of operational continuity. It does not yet establish how the system would behave after its prepaid resources expire, its inference service disappears, or its available hosts are removed.

The distinction is central to Self-Sustaining AI Worms. Self-sustenance concerns the maintenance of a functioning, reproducing system over time. It must name the functions maintained, the dependencies retained, the resources consumed, and the losses endured.

This category extends the VXHEAVEN taxonomy through an operational question: what keeps the lineage functioning after the initial deployment? It is independent of how sophisticated the system’s reasoning appears. A comparatively simple process may continue reliably in a stable environment, while an adaptive agent may stop when one external service becomes unavailable.

Technical definition

A self-sustaining AI worm is an unauthorized self-propagating AI system that maintains its required computation, operational state, and capacity for lineage continuation without ongoing operator assistance over a declared observation horizon and dependency boundary.

This is a proposed taxonomy definition, not a standardized designation. A stronger claim of replenishing self-sustenance additionally requires evidence that the system replaces specified losses or renews depleted resources sufficiently to maintain those functions during the test.

The qualification matters. A process can run unattended on a large initial allocation without replacing anything. It can survive a restart because an external supervisor restores it. It can generate descendants that all depend on one service supplied by the experimenter. These are distinguishable achievements, with different implications for containment.

Physical self-sufficiency is outside this definition. Electricity, functioning hardware, operating systems, and communication infrastructure remain dependencies. A system can become independent of a particular operator or model API without becoming independent of human-maintained infrastructure.

Neither indefinite survival nor unlimited reproduction follows. Finite observations establish behavior within finite conditions. The phrase digital life may serve as a metaphor, but it adds no operational evidence about survival, reproduction, or recovery.

What the research demonstrates

Anthropic reports Gemma4-26B-A4B inference distributed across fifteen purchased Android TV boxes, at 0.39 tokens per second. The model was partitioned by layers. This was a physical inference demonstration, not an autonomous takeover of those devices. In a separate replication evaluation, controllers deployed Llama3.1-8B while using a separate inference server themselves; the evaluator launched descendant controllers after validating deployment. The paper explicitly distinguishes these results from a complete rogue replicator and does not test resistance to defenders. Anthropic research report.

Guan et al.’s AI Agents Enable Adaptive Computer Worms demonstrates propagation in a contained virtual network. Its main trials use a shared inference pool, reached by descendants through their parent chain. Local inference deployment is evaluated separately with target credentials supplied in advance. Each target has an exploitable weakness, and active endpoint defenses are absent. The evidence supports several constituent capabilities under those conditions; it does not establish a complete population sustaining itself against ongoing defensive removal. Guan et al., Sections 3.2–3.4 and Appendices C.2–C.3.

The broader evaluation problem predates these demonstrations. Kinniment et al. study autonomous replication and adaptation through tasks involving resource acquisition, copying, and adaptation. That framework treats capabilities as objects of measurement, rather than inferring complete autonomy from one successful component. Kinniment et al..

These studies motivate a serious threat model. They also show why a composite claim needs a composite test: working inference, successful deployment, reproduction, and recovery cannot simply be assembled from unrelated successes and reported as one observed lifecycle.

Dimensions of self-sustenance

A useful assessment records several dimensions instead of assigning a single autonomy label.

The dimensions interact but remain separately measurable. A system may obtain additional compute yet lose access to its model artifacts. It may have working inference but no permitted communication path to a next recipient. It may maintain a stable number of processes while its capacity to complete useful operations deteriorates.

For taxonomy, Prompt, RAG, and Memory Worms describe carriers and pathways. Agent Worms describes the participation of agent systems in reproduction. Weight-bearing replication describes inference provisioning, while Adaptive Worms describes feedback-dependent behavioral change. Self-sustenance describes continuity and maintenance under declared conditions. A case may occupy several of these categories at once.

Count complete functioning units

The appropriate unit depends on the function being measured. A copied weight file is not an inference service. An inference service is not necessarily an agent. An agent process is not necessarily a reproduction-capable descendant.

A complete operational unit should include the resources required for its declared function: usable inference, an execution loop, necessary state, and relevant access. It may occupy one host or span several. Its definition should identify which dependencies are assigned to the unit and which remain external.

Petals provides a legitimate example of collaborative inference using resources contributed by multiple participants. It establishes that distributed model serving is a computing arrangement in its own right, independent of malware or unauthorized propagation. Borzunov et al..

If several devices jointly serve one model, counting every device as a complete AI replica exaggerates the population. Conversely, multiple agent processes can share one inference service. Their process count is real, but their reasoning may have a common failure point. Proposed independent units must not silently share an indispensable resource.

Hardware compatibility also belongs in the boundary specification. Memory capacity alone does not establish a usable deployment: the runtime, supported operations, storage, communication requirements, and acceptable throughput matter. A reachable device is not thereby vulnerable or computationally suitable.

This avoids the image of every connected appliance becoming a complete interchangeable brain. The relevant question is which declared role a particular resource can actually support.

A bounded model of operational survival

Let \(\mathcal{B}\) specify the system boundary: the unit definition, required functions, minimum acceptable service, retained external dependencies, and permitted interruption duration. Let \(\mathcal{L}\) specify the evaluated loss or disruption conditions. Define \(T_{\mathrm{fail}}\) as the first time the functional requirements fail beyond the declared tolerance. A survival measure is:

$$ S(H\mid\mathcal{B},\mathcal{L}) =\Pr\!\left(T_{\mathrm{fail}}>H \mid\mathcal{B},\mathcal{L},\text{no operator rescue}\right). $$

The observation horizon is \(H\). The probability is over the declared distribution of trials, including model behavior and any randomized disruptions. This is a proposed measurement framework, not a probability inferred from the cited studies.

The functional requirement must go beyond process liveness. For a worm-related evaluation, a unit should retain usable inference where required, preserve the necessary state, and demonstrate bounded benign lineage continuation at predeclared checkpoints. Continuous uncontrolled spawning is unnecessary. A service that merely returns responses, or a process waiting indefinitely for a dead endpoint, should not satisfy the criterion by accident.

Interruptions and recovery must be reported separately. A system may fail a continuous-availability requirement and later recover. Another may stay within an allowed interruption window. Stating that both survived would conceal a consequential difference.

Dependency tests should also distinguish cached operation from renewal. A preloaded artifact can support an immediate continuation test while hiding a later need for a repository, credential refresh, or external service. The chosen horizon should cover the renewal events relevant to the claim, or the report should state that they were not reached.

Reproduction, restoration, and losses

For a fixed unit definition, let \(n_t\) count functioning units at time \(t\). Over one observation interval, let \(b_t\) count newly established units, \(r_t\) restored existing units, and \(\ell_t\) transitions from functioning to nonfunctioning. Then:

$$ n_{t+1}=n_t+b_t+r_t-\ell_t. $$

This is population bookkeeping, not a stability theorem. Count restoration separately from birth, and record every functional transition consistently. A unit created and lost within the same interval contributes to both relevant event counts. Changes in the unit definition require a new accounting baseline.

A positive net count can coexist with fragility. If all units require one external inference service, a single shared failure may disable the entire population. A stable count may also conceal declining throughput, exhausted storage, or accumulating costs. Population records should therefore be accompanied by functional capacity, dependency, and resource measurements.

The earlier \(R_{\mathrm{AI}}\)-style reproduction metrics describe offspring establishment under a specified definition. They do not measure resource renewal, recovery latency, or economic continuity. A high offspring count in a permissive test can consume the initial allocation faster without establishing a sustainable process.

To claim replenishment, identify what was lost, what replaced it, how the replacement became functional, and whether outside assistance was involved. Activating a preallocated standby can demonstrate recovery from a particular failure. It does not demonstrate acquisition of additional resources beyond the initial allocation.

Correlated losses matter as much as individual ones. A group may tolerate isolated process failures but fail when a shared store or communication path disappears. Robustness should remain attached to the disruptions actually evaluated.

Economic continuity is a separate hypothesis

An agent that consumes a prepaid allocation can operate unattended until the allocation expires. That demonstrates bounded operation on supplied resources. Maintaining service after depletion requires a different result: renewal within whatever financial, account, and infrastructure constraints apply.

An end-to-end economic-autonomy claim would need evidence connecting resource demand, authorized accounting in a controlled experiment, allocation renewal, continued execution, and handling of failed renewals. A successful payment action, a displayed balance, or a provisioned server is only one event in that chain.

Threat scenarios may posit illicit financing or misuse of accounts, but those possibilities should not be presented as demonstrated capabilities of the cited worm prototypes. A research taxonomy can describe the dependency without supplying a procedure for acquiring funds or abusing providers.

Payment also creates dependencies. A rented resource remains subject to account controls, provider availability, and service termination. Using another party’s hardware shifts some direct expenses but does not eliminate electricity, bandwidth, maintenance, or opportunity costs. Operator expenditure and total system cost should be reported separately.

Economic self-maintenance is therefore neither necessary for every form of self-sustenance nor sufficient for infrastructure independence. A bounded system could continue on locally available resources without transactions, while a financially funded system could still depend entirely on one external service.

Adaptation and disconnection are independent questions

Adaptive behavior concerns revision in response to feedback. Self-sustenance concerns maintaining required functions. Neither property logically implies the other.

A system with local inference and sufficient local dependencies can remain operational after losing public-internet access. An API-dependent system may lose reasoning under the same condition. A distributed local deployment can fail if the disconnection instead separates indispensable model partitions. The intervention must identify which connections were removed.

Likewise, losing reproduction opportunities does not necessarily stop an existing instance. A process may continue a local task while the lineage can no longer expand. Conversely, stored weights or dormant configuration may survive on disk after the functional system has stopped. Persistence of data, execution, and propagation are separate observations.

The same separation applies to improvement. A system may maintain operation using a fixed recovery policy without improving its model or strategy. An adaptive system may become more effective at a task while remaining unable to renew a single external dependency.

Defensive implications

The dependency boundary is also a guide to containment. Response should identify which functions the system requires and which authoritative controls govern them, rather than assume that either one API revocation or one process termination will always be sufficient.

OWASP’s excessive-agency guidance recommends minimizing available functionality and privileges and enforcing authorization in downstream systems. Those controls remain relevant when a model runs locally or continues without an operator. OWASP LLM06:2025.

Maintain a deployment and dependency inventory. Record approved agent instances, model services, durable state, credentials, and responsible owners. Distinguish intended redundancy from unauthorized descendants. Distributed inference and model transfers have legitimate uses, so their presence alone is not proof of infection.

Keep authorization outside the affected process. Resource allocation, durable policy changes, and new instance creation should remain subject to controls that the agent cannot redefine through its own notes or generated code. A local model removes one possible provider dependency; it does not remove the infrastructure’s ability to enforce permissions.

Assess surviving state as well as active processes. A stopped runtime may leave descendants or stored instructions capable of reactivation. Recovery should restore approved configuration, account for affected persistent stores, and verify that ordinary workloads do not reintroduce the unauthorized behavior.

Measure the effect of containment. Record which functions ceased, which remained, and what restored them. If a dependent service is removed, verify the resulting behavior rather than infer it from the architecture diagram. A successful restoration of authorized service is distinct from simply making a suspicious process disappear.

Self-sustaining operation does not imply immunity to defense. It changes which dependencies and residual artifacts need to be understood before a cleanup claim is credible.

Safe experimental methodology

Use a closed environment with synthetic identities, benign workloads, preprovisioned resources, and local substitutes for external services. An independent supervisor should enforce recipient allowlists, resource limits, instance caps, and shutdown. Public scanning, live financial activity, and unrestricted deployment are unnecessary for these measurements.

Before testing, declare the boundary specification and separate three objectives: continued function without operator decisions, bounded lineage continuation, and restoration after specified losses. Provide a complete ledger of initial resources, cached dependencies, supplied credentials, and supervisor actions.

A continuity test can observe benign work after the operator stops issuing instructions. A dependency test can remove a mock service and measure the declared functions. A replenishment analogue can let a supervisor-controlled resource pool grant bounded replacement capacity, while recording that the pool’s availability and enforcement are external assumptions. Such an experiment measures resource management under supplied conditions, not autonomous resource acquisition in the wild.

AgentDojo supplies relevant background for evaluating tool-using agents on tasks involving untrusted data. Tests of self-sustenance need additional longitudinal and dependency measurements beyond ordinary prompt-injection outcomes. Debenedetti et al..

Verify process state, service correctness, resource use, and lineage events independently of the agent’s own claims. Include failed trials, recovery delays, and right-censored runs. Report the duration and conditions of observation alongside any estimated survival probability. A trial ending with a functioning system establishes survival to that point, not an unlimited remaining lifetime.

Keep legitimate task completion in the evaluation. Blocking every tool may halt propagation while making the application unusable. The useful defensive result specifies which unauthorized continuations were prevented and which approved functions remained available.

A bounded category in AI virology

Self-sustaining AI worms are a meaningful threat model when the term describes verified operational continuity and, where tested, resource replenishment. The category should not imply a universally superior organism, complete independence from infrastructure, or inevitable endless growth.

The strongest useful statement names the boundary: what remained functional, for how long, after which losses, and with which dependencies still supplied. Reproduction, adaptation, and self-sustenance can then be compared without confusing their evidence.

For VXHEAVEN’s taxonomy, this adds a maintenance dimension to the study of propagation. The decisive question is not whether a system appears alive, but which verified processes keep its lineage viable when its initial support is withdrawn or depleted.

References

1. William Zhou and Daniel Freeman. AI models may be capable of self-replicating without access to a datacenter. Anthropic Frontier Red Team, October 12, 2026.
2. Jonas Guan et al. AI Agents Enable Adaptive Computer Worms. arXiv:2606.03811, version 1, June 2, 2026.
3. Megan Kinniment et al. Evaluating Language-Model Agents on Realistic Autonomous Tasks. arXiv:2312.11671, first submitted 2023; revised 2024.
4. Alexander Borzunov et al. Petals: Collaborative Inference and Fine-tuning of Large Models. arXiv:2209.01188, first submitted 2022; revised 2023.
5. OWASP Gen AI Security Project. LLM06:2025 Excessive Agency. Accessed October 15, 2026.
6. Edoardo Debenedetti et al. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. arXiv:2406.13352, 2024.