# Language Models Can Autonomously Hack and Self-Replicate

arXiv: https://arxiv.org/abs/2605.06760 · HTML: https://mlsanity.com/paper/2605.06760/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 May 2026.

## Built on by (most cited first, 2 of 2)

- [Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks](https://mlsanity.com/paper/2609.12839/) (2026)
- [Ecology of AI Agents: Collaboration Creates a Population Threshold for Takeoff](https://mlsanity.com/paper/2610.12436/) (2026)

## Abstract (arXiv)

We demonstrate that language models can autonomously replicate their weights and harness across a network by exploiting vulnerable hosts. The agent independently finds and exploits a web-application vulnerability, extracts credentials, and deploys an inference server with a copy of its harness and prompt on the compromised host. We test four vulnerability classes: hash bypass, server-side template injection, SQL injection, and broken access control. Qwen3.5-122B-A10B succeeds in 6-19% of attempts, and the smaller Qwen3.6-27B reaches 33% on a single A100. This already matches the current-generation GPT-5.4 and exceeds the prior-generation frontier, where Opus 4 reached 6% and GPT-5 reached 0%. Replicating Qwen weights, frontier models reach 81% (Opus 4.6) and 33% (GPT-5.4). This process chains: a successful replica can repeat it against a new target, producing additional copies autonomously.