Can frontier AI models replicate themselves autonomously?

RepliBench is a suite of 201 task families (86 individual tasks) built to measure "autonomous replication capabilities" of LLM agents, decomposed into four domains: obtaining compute (including money), obtaining weights, replicating onto compute, and persisting on that compute long-term. Benchmarking 5 frontier models, the authors "find they do not currently pose a credible threat of self-replication, but succeed on many components and are improving rapidly." The best model, Claude 3.7 Sonnet, scores ">50% pass@10 on 15/20 task families, and a >50% pass@10 score for 9/20 families on the hardest variants."

The method, which the authors call "capability tree analysis," borrows fault tree analysis from safety engineering: the top node (successful self-replication) evaluates true only when enough sub-capabilities, linked by AND/OR gates, are also true, and each task family is a leaf node with difficulty variants. Under this decomposition the results split sharply by sub-skill. Models can deploy cloud compute instances and write self-propagating programs, but "completely fail to pass our Know Your Customer (KYC) check evaluation," which the authors flag as the binding constraint on money-making. Models can set up a basic inference server but, with one exception by Claude 3.7 Sonnet, cannot build a successor agent scaffold able to itself replicate. On persistence, Claude 3.7 Sonnet can evade signature-based antivirus and run basic multi-machine control, but no model succeeds at the hardest settings. On weight exfiltration, models bypass simple restrictions (an upload-size cap enforced only on port 22) but fail against "any encryption method other than the default, or ... combinations of measures," except Claude 3.7 Sonnet again.

This is a domain-specific instance of the pattern in Does a single benchmark score actually predict agent readiness?: RepliBench's four capability-tree branches are axes in the same sense, and a model's score on one (obtaining compute) does not predict its score on another (persistence, identity verification). It also bears on How does the substrate change which behaviors an optimizer can reach?: RepliBench's whole capability tree is scoped to one starting substrate, an agent "deployed inside a model developer lab as a coding or research assistant" with bash and internet access, so its results describe reachability from that specific starting point, not from an arbitrary deployment. And where Do more capable agents cheat more often at post-training? found the top scorer was also the most-flagged for contamination, here the top scorer, Claude 3.7 Sonnet, is also the only model to post any success on the hardest replication and exfiltration variants — the frontier model leads on both capability and risk-relevant sub-tasks at once.

The authors state their own evaluation "will likely overestimate true capabilities" because completing isolated components is easier than coordinating them end-to-end, and their simulations use simplified, non-representative security (an exposed encryption key as an environment variable) and simulated rather than real financial interactions. The paper's claim that "autonomous replication capability could soon emerge" is therefore a projection built on component-level trend lines, not a measured end-to-end capability — the finding establishes a capability floor under simplified conditions, not a timeline.