AI’s Next Problem Is Replication, Permission, and Politics

AI is approaching its most awkward phase. Anthropic’s Frontier Red Team says small models may be only months away from replicating and spreading across insecure devices, creating autonomous botnets that move slowly but resist removal. The same industry is now promising publishers more control over training scrapes, just as Anthropic prepares to face investors and a political climate turning against its data centers.

Experts broadly agree that small models could become capable of self-replication in the near future, though they disagree about what that would look like. Chris Canal, CEO of EquiStamp, said the timeline arrived earlier than expected: “I would have predicted something more like summer of next year as the time I’d be really worried about this.”

Canal attributes the pace to frontier-lab employees using their own AI tools to conduct machine learning research. He also said Anthropic may have information about the research frontier that he does not, meaning its prediction could be better informed. That is not comforting, but it is at least a reason.

Michael Bailey, a professor at the School of Cybersecurity and Privacy at Georgia Tech, has studied internet worms since the early 2000s and botnets more recently. He says self-replicating models are “in the future,” are real, and will be seen, but whether they take the exact form and produce the consequences Anthropic describes remains “a completely open question.”

The old threat gets cheaper

Bailey co-wrote Understanding the Mirai Botnet in 2017, research Anthropic cites. Mirai let cybercriminals assemble a large botnet from everyday devices, including cable routers and IP cameras running on different chip architectures, then use it in a DDoS attack against Sony’s PlayStation Network.

The attack affected Dyn, one of the largest DNS providers in the US, and broke much of the internet in 2016. Amazon, GitHub, PayPal, Reddit, and Twitter went offline for many users across the US and parts of Europe, while Sony estimated about $2.7 million in lost net revenue.

Adaptability itself is not new. Mirai already worked across “heterogeneous” devices, but each new architecture required human labor, at minimum recompiling the malware. More capable models could redistribute who performs that work and change the economics between attackers and defenders.

Bailey says Anthropic demonstrated a model hopping between devices and setting up inference on each, but the test used an emulated network where the exploit was trivial. He also objects to calling the result full self-replication: the system used sharding, not a worm or virus copying itself across every architecture.

A real-world AI botnet may look more like a dropper, Bailey says. Malware could gain a foothold, install a small coordination tool, and take instructions from elsewhere in the network. “It’s not going to do new stuff,” he said. It may still make old stuff cheaper to scale.

Permission arrives after the scraping

Google, Anthropic, OpenAI, and Microsoft have committed to honoring a new robots.txt directive for AI-training scrapes. The proposal, written by Anthropic technical lead for standards Kevin Kelley, is under consideration at IETF and uses the user agent “__usage_ai-training” to let publishers allow or block specific training access.

A site could use “User-Agent: __usage_ai-training Disallow: / Allow: /press-kit/” to block training scrapes across the site while permitting access to a press kit. The directive does not stop crawling altogether or affect Google search, and Google will treat it as a stop sign for the “Google-Extended” user agent used to gather material for Gemini models.

There is one small catch, because technology policy enjoys arriving after the data. The signal cannot undo earlier scraping; if a company already crawled a page, it already has the content. Anthropic supports the directive now, OpenAI plans to implement it in the coming months, Google says early 2027, and Microsoft says February 1, 2027.

Anthropic filed paperwork to go public on Monday, with an expected IPO around mid-November. Its risk factors span sentient AI and the less cinematic possibility of losing executives, but the sharper issue is an “evolving and uncertain regulatory and political environment.”

Americans of both parties oppose data centers and worry about AI displacing jobs, while the current Republican-controlled Congress has not put its political will behind constraining AI companies. As of this August, CNN found Democratic and Republican candidates had spent more than $35 million on campaign ads opposing data centers, and 8 percent of video ads mentioned them, up from 1 percent a year earlier.

That pressure is spreading through battleground races. NBC News ranks Ohio’s Senate race as a toss-up, and a private August memo from the National Republican Senatorial Committee warned that Jon Husted could lose his seat over data centers: “More than any other thing in this race, data centers are the anchor hanging around Husted’s neck.”

The Ohio Chamber of Commerce found the state gave $2.5 billion in tax breaks to facilities from 2017 to 2024, when Husted was lieutenant governor. Democratic candidate Sherrod Brown has made opposition central to his platform, saying data centers “eat up our land,” “swallow up our water,” and push electricity prices higher; voters gave Brown an 11 percentage-point advantage over Husted on managing their development.

New Jersey hopefuls Adam Hamawy and Watson Coleman want to slow expansion across at least 80 data centers. In Pennsylvania, Josh Shapiro and Stacy Garrity accuse each other of flip-flopping, while in Texas, James Talarico and Gina Hinojosa want to repeal the 20 years of tax breaks Greg Abbott signed in 2015.

Talarico also supports closed-loop cooling systems and local authority to reject facilities. He holds a narrow polling lead despite Elon Musk spending more than $276 million to aid Ken Paxton; if Talarico wins, he would become the first Democrat to represent Texas in the Senate since 1993.

Other proposals are tougher still. Abdul El-Sayed’s “AI Under Control” plan calls for pausing AI model training, creating a Cabinet-level agency to inspect AI labs, and restricting data center buildouts; Oregon’s Ron Wyden wants to strip their tax breaks, while Sanders and Ocasio-Cortez back legislation pausing AI model development.

Anthropic may have timed its IPO to buy a few months before the political environment hardens and public sentiment turns further against AI. The industry is trying to solve three problems at once: machines that may spread themselves, companies that already possess scraped data, and infrastructure that voters increasingly treat as a liability. Ambition remains abundant. Permission is catching up.

Stay connected via Google News

Follow us for the latest AI News