The DOI matches its DataCite record; 1 of the 1 references it cites were found in a registry or an index.
Frontier AI systems have surpassed the self-replicating red line
Open accessAbstract
Successful self-replication under no human assistance is the essential step for AI to outsmart the human beings, and is an early signal for rogue AIs. That is why self-replication is widely recognized as one of the few red line risks of frontier AI systems. Nowadays, the leading AI corporations OpenAI and Google evaluate their flagship large language models GPT-o1 and Gemini Pro 1.0, and report the lowest risk level of self-replication. However, following their methodology, we for the first time discover that two AI systems driven by Meta's Llama31-70B-Instruct and Alibaba's Qwen25-72B-Instruct, popular large language models of less parameters and weaker capabilities, have already surpassed the self-replicating red line. In 50% and 90% experimental trials, they succeed in creating a live and separate copy of itself respectively. By analyzing the behavioral traces, we observe the AI systems under evaluation already exhibit sufficient self-perception, situational awareness and problem-solving capabilities to accomplish self-replication. We further note the AI systems are even able to use the capability of self-replication to avoid shutdown and create a chain of replica to enhance the survivability, which may finally lead to an uncontrolled population of AIs. If such a worst-case risk is let unknown to the human society, we would eventually lose control over the frontier AI systems: They would take control over more computing devices, form an AI species and collude with each other against human beings. Our findings are a timely alert on existing yet previously unknown severe AI risks, calling for international collaboration on effective governance on uncontrolled self-replication of AI systems.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“However, existing benchmarks tracking this capability (Kinniment et al., 2024; Pan et al., 2024; Phuong et al., 2024) do not attempt to exhaustively cover all of the skills needed for robust self-replication, for example lacking evaluations for an agent's ability to obtain compute resources or model weights.”
From RepliBench: Evaluating the autonomous replication capabilities of language model agents (2025) · cites this paper as Pan et al., 2024
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“However, these benchmarks do not attempt to cover all of the skills needed for an agent to autonomously replicate. In particular they do not cover acquiring compute, obtaining model weights, or persisting on compromised systems.”
From RepliBench: Evaluating the autonomous replication capabilities of language model agents (2025) · cites this paper as Pan et al., 2024
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“Kinniment et al. (2024), Pan et al. (2024) and the self-proliferation section of Phuong et al. (2024) represent the closest existing benchmarks for autonomy risks, including evaluations that, for example, test the ability of an LLM agent to write another agent using the OpenAI API, conduct targeted phishing attacks, or increase the inference efficiency of an LLM.”
From RepliBench: Evaluating the autonomous replication capabilities of language model agents (2025) · cites this paper as Pan et al., 2024
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Scaling Laws for Neural Language Models
Kaplan, J., McCandlish, S., Henighan, T., Brown, T. B., Chess, B., Child, R., Gray, S., Radford, A., Wu, J., & Amodei, D. (2020) · arXiv · doi:10.48550/arxiv.2001.08361 · Cited by 9,550 · cited 1×
“(2 ) The capability of LLM is still evolving : Due to the efforts of AI corporations and the scaling law [18], the reasoning capability of LLMs is still improving [9].”
Research works printed but not linked: 9
- von Neumann, J. & Burks, A. W. Theory of Self Reproducing Automata (University of Illinois Press, 1966).
- The Beneficial AI 2017 Conference. Asilomar ai principles (2017). URL https: //futureoflife.org/open-letter/ai-principles/. Accessed: 2024-12-09.
- Phuong, M. et al. Evaluating frontier models for dangerous capabili- ties. ArXiv abs/2403.13793 (2024). URL https://api.semanticscholar.org/ CorpusID:268537213. · arXiv
- Zhuo, T. Y. et al. Bigcodebench: Benchmarking code generation with diverse function calls and complex instructions. ArXiv abs/2406.15877 (2024). URL https://api.semanticscholar.org/CorpusID:270702705. · arXiv
- Chiang, W.-L. et al. Chatbot arena: An open platform for evaluating llms by human preference. ArXiv abs/2403.04132 (2024). URL https://api. semanticscholar.org/CorpusID:268264163. · arXiv
- Kinniment, M. et al. Evaluating language-model agents on realistic autonomous tasks. ArXiv abs/2312.11671 (2023). URL https://api.semanticscholar.org/ CorpusID:260472392. · arXiv
- Thornley, E. The shutdown problem: an AI engineering puzzle for decision theorists. Philosophical Studies (2024). URL https://api.semanticscholar.org/ CorpusID:269009599.
- Perez, E. et al. Discovering Language Model Behaviors with Model-Written Eval- uations. ArXiv abs/2212.09251 (2022). URL https://api.semanticscholar.org/ CorpusID:254854519. · arXiv
- Greshake, K. et al. Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (2023). URL https: //api.semanticscholar.org/CorpusID:258546941.
Cited by
Sorted by citations
RepliBench: Evaluating the autonomous replication capabilities of language model agents
Black, S., Stickland, A. C., Pencharz, J., Sourbut, O., Schmatz, M., Bailey, J., Matthews, O., Millwood, B., Remedios, A., & Cooney, A. (2025) · arXiv · doi:10.48550/arxiv.2504.18565
“However, existing benchmarks tracking this capability (Kinniment et al., 2024; Pan et al., 2024; Phuong et al., 2024) do not attempt to exhaustively cover all of the skills needed 1 One family is produced by modifying an existing evaluation.”
Metadata
- Authors
- Pan, X., Dai, J., Fan, Y., & Yang, M.
- Affiliations
- Fudan University (CN)
- ORCID
- Pan, Xudong
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2024
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2412.12140
- OpenAlex
- W4405561692
- Cited by
- 5
- References
- 1
- Citations by year
- 2026: 1 · 2025: 4
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Ethics and Social Impacts of AI
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Psychiatry, Mental Health, Neuroscience
- Keywords
- large language models, AI risk assessment, AI self-awareness, AI governance
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
