Much of the AI industry is built on stories, from the idea that AI could kill us all to the goal that it might one day become superintelligent. This often leads to problems, because when people have a story in their head, they don鈥檛 always look at the facts on the ground to check that they actually match the fiction. That has happened this week, with widely reported claims from Anthropic that we are mere 鈥渕onths away鈥� from . That鈥檚 a great headline, and it鈥檚 hard to resist clicking, but it almost certainly isn鈥檛 true.

Let鈥檚 start with looking at what Anthropic has actually done. Two researchers at the company, and , ran an experiment in which they installed a small AI model, Gemma4-26B-A4B, across 15 Android TV boxes, the kind of thing you might plug into a TV to gain access to streaming apps. Such devices are computational weaklings, with tiny CPUs (the processor that runs software) and little RAM (the memory that stores data for software while it runs), which is why the Anthropic researchers needed 15 to store one model. Even then, the model could produce only 0.39 tokens per second, the unit of AI input and output, which is roughly equivalent to 18 words per minute. This is painfully slow 鈥� around 10 times slower than normal human speech.

Nothing in this part of the experiment is surprising. We know that AI models normally need to run on GPUs, a specialised and more powerful type of processor than a CPU, and large numbers of them 鈥� that is why AI firms are building massive data centres. What Zhou and Freeman argue is that such that a model distributed across TV boxes, smart ovens or other internet-enabled appliances could endlessly copy itself to create a form of 鈥渄igital slime mold鈥� that gums up a large chunk of these devices globally. Those three words are great, concise storytelling, but they paper over what鈥檚 really happening here.

When they actually tried to get a model to copy itself in this way, it failed. Three models were unable to set themselves up at all. A fourth model, GLM-5.2, succeeded in four out of five tests, but only at setting up another model, Llama3.1-8B, which is about 100 times smaller. The pair argues this is a fair test because it shows that a future smaller model with the same capabilities as GLM-5.2 could set itself up, but this is still far from self-replication. The claim that such a feat might be 鈥渕onths away鈥� comes from extrapolating lines on a graph.

Putting all those objections aside, the broader question is why would anyone want to create self-replicating software? We already have an answer for that, and it doesn鈥檛 involve AI. Computer code that copies itself from one device to another is called a worm, and they have existed for more than 50 years. In the 1970s, Bob Thomas and Ray Tomlinson at US firm BBN (the latter invented email, as it happens) created a . It was not particularly complicated, and merely output the message 鈥淚鈥橫 THE CREEPER: CATCH ME IF YOU CAN鈥�. Tomlinson paired this with Reaper, a piece of code designed to find and delete Creeper, making it the first antivirus software.

It wasn鈥檛 until about a decade later that such self-copying software was called a worm, after a term coined in the sci-fi novel The Shockwave Rider by John Brunner 鈥� storytelling becomes useful again. John Shoch and Jon Hupp at Xerox Palo Alto Research Center, arguably the Anthropic of its time, to describe how an experimental worm 鈥渟eemed to grow out of control鈥�, leaving 鈥渄ozens of machines dead鈥�. Sound familiar?

Big, clunky worms

was deployed on to the internet in 1988 by Robert Morris, a student at Cornell University in New York state. It is thought that thousands of computers were infected and crashed, a significant chunk of the online population at the time, and Morris became the first person charged under the US Computer Fraud and Abuse Act. Today, worms are deployed by cybercriminals to hijack computing hardware and make money. For example, in 2017 the was the result of a worm copying itself across computers and encrypting them, demanding payment in bitcoin to unlock. It infected more than 200,000 computers in a single day, including many in the UK鈥檚 National Health Service, and caused an estimated $4 billion in economic losses, although only around $100,000 of that was people paying the ransom.

If worms can be that bad, surely an AI-powered worm would be even worse? Actually, no, because an AI worm would find it much harder to replicate. According to Zhou and Freeman鈥檚 experiment, it would take multiple days for their AI worm to copy itself just once. That doesn鈥檛 mean such a worm couldn鈥檛 scale to large numbers, but it would be slower, taking more than two weeks to achieve the 200,000 devices WannaCry managed in a single day. That is because even small models like Gemma4-26B-A4B are large files 鈥� around 14 GB for the version in the experiment, which is about 4000 times larger than WannaCry 鈥� and these take time to transfer. That would make an AI worm much more noticeable, as network managers would be likely to investigate the source for such large data transfers and shut them down 鈥� something Zhou and Freeman admit.

What does an AI worm gain from all that extra data? Not a lot. Zhou and Freeman say that, assuming it could take more than 2 million Android TV boxes, the computing power available would be equivalent to around 40 high-end GPUs. To put that in context, leading AI firms like Anthropic typically operate hundreds of thousands these computer chips, and it would cost you around $100 an hour to rent access to that much computing power. It is hard to see why a cybercriminal would choose to do this rather than use a standard worm like WannaCry.

This is where we come back to storytelling. A long-standing fear for many in the AI sphere is that a model could 鈥渆xfiltrate鈥� itself, distributing itself across the internet and so resisting being shut down (before presumably killing us all, for some reason). Anthropic 鈥渨histleblower鈥� Jacob Coxon . Could it be that an AI worm is proliferated by such an AI, rather than a human cybercriminal? Well, maybe. But the models that are most effective at hacking are also the largest ones 鈥� Mythos, a model Anthropic refused to release to the public because of its hacking capabilities, is estimated to require dozens of terabytes of storage and is more than 1000 times larger than Gemma4-26B-A4B. This is not something you sneakily copy around the internet, but it does make a great digital ghost story.

What I find particularly interesting is that this story about theoretical AIs hacking into devices and copying themselves seems to be crowding out a very important fact: actual AI hackers that attack computers already exist, and they are running on Anthropic鈥檚 own servers. In July, of a model gaining unauthorised access to third-party organisations. This was discovered only after an investigation prompted by reports that OpenAI鈥檚 models had done the same. Since then, more and more reports of such hacking have come out, including an OpenAI hack of an Australian government website, and on unnamed third-party breaches that came out just a few days before the AI worm research was published. The AI firms say they are taking steps to avoid this happening in the future, but it seems to me that big AIs on powerful server farms are the thing we need to worry about, not a model barely capable of sputtering out a few words per minute. Yes, future smaller models may become more capable, but hardware is always going to be a constraint 鈥� not least because the rise of AI server farms means that consumer hardware is seeing RAM shortages.

As I said at the top of this article, a self-replicating AI that takes over your smart oven is a great story, and I can see why it has spread so rapidly. But stories like this are a cognitive worm, hacking your critical thinking abilities by going straight for your fear response. Could this someday be a concern? Perhaps, although this article has hopefully poked holes in some of the storytelling logic behind the idea. Is it something we need to worry about in the next few months? Absolutely not.

Further AI reading

• OpenAI announced that a 鈥溾�� was found hidden in its offices. The company says it used its own AI models to investigate the device and traced it to a specific employee, who has been . OpenAI says it has no indication that any proprietary or customer data was accessed 鈥� but who needs a malicious AI when humans are ready and able to do the job?
• Character.ai is . The service let users create 鈥渃haracters鈥� with specific personalities and it has courted controversy and multiple lawsuits over and .
• Epic Games, the makers of Fortnite and other video games, is pivoting towards using AI. 鈥淭he aim isn鈥檛 to do the same stuff with fewer people, but to enable everyone here to build MORE and BETTER stuff鈥�, . Games have been surprisingly resistant to AI, with multiple controversies about the technology鈥檚 use in game development exploding in recent years, but when one of the biggest game-makers on the planet goes all in, it may be hard to ignore.

A few years ago, when I first started talking about mathematics in public, a professor of algebraic number theory pulled me to one side and gave me some sharp words of warning: 鈥淭he world fears mathematicians, Hannah. Let鈥檚 keep it that way.鈥�

He was being, to put it mildly, a bit of a snob. Maths had an intimidating mystique to maintain, and I was apparently jeopardising it by titting around on the internet making videos and podcasts, rather than focusing on a perfectly respectable research career.

Free newsletter

Sign up to Professor Hannah Fry鈥檚 column

Sign up to newsletter

I have thought a lot about that comment since. Partly because I have spent the intervening years doing everything I can to completely ignore him (and getting a New 精东传媒 column feels like a rather lovely reward for doing so).

But buried beneath his snobbery, I have come around to the idea that he was right about something. And I have never felt that more than in the past few weeks, since a swarm of AI agents have been busy solving our most famous long-standing problems.

I鈥檓 talking, of course, about OpenAI鈥檚 announcements over the past few weeks that it has found proofs for hundreds of mathematics problems that had previously resisted human attempts to solve them.

The furore began, most notably, with a proof (by way of finding a counterexample) that the Navier-Stokes equations can break apart. This particular gem was such a big deal to the mathematical community that at the turn of the millennium, the Clay Mathematics Institute promised they鈥檇 give $1 million to whoever managed to solve it.

Those Navier-Stokes equations are what I did my PhD on. They are basically Isaac Newton鈥檚 second law of motion: F=ma, but applied to fluids. They are, in my not entirely unbiased opinion, staggeringly beautiful, able to articulate everything from the drip of a water droplet on a leaf and the churn of an entire atmosphere to the gases swirling around in a galaxy in the sky.

The thing is, these equations have a tricky little bit that pops out of the acceleration part, which contains a feedback loop within it. The faster fluid flows, the faster the gradient can get between two adjacent streams, and so the faster fluid flows. It鈥檚 a bit like the fluid version of putting a microphone next to a speaker. The feedback loop can get louder and louder until everything ends up breaking. Or, in the case of the Navier-Stokes equations, the speed of the flow heads off to infinity.

To be clear: no one was ever worried about fluid dynamics tearing open a black hole when you stir your tea or anything. It was just that the weird behaviour of this little term left the possibility that the equations themselves would break.

On the flip side, there鈥檚 another term in the equation 鈥� the viscosity 鈥� that acts as a brake and calms everything down, stopping the flow from getting completely out of control. So, the question was: does the brake always kick in?

If you have been following the story, then by now you will know what happened. Various groups of mathematicians had been using AI to circle in on this problem, finding special cases where the feedback loop goes crazy, without quite getting to the full Navier-Stokes.

But supposedly, once OpenAI heard that others were getting close, they threw everything at it: 10,000 AI agents, sending each other 3 million messages over 88 hours, costing millions of dollars in tokens, to find a single example where everything blows up. The Navier-Stokes equations do indeed fall. And an AI proved it.

This should have been a glorious moment of scientific exposition, but instead, mathematicians have spent the last few weeks having a massive collective wobble.

Part of the reason is that nobody yet understands the answer. The OpenAI solution is almost hilariously ugly. It is a proof that鈥檚 166 pages long, accompanied by hundreds of thousands of lines of formal code 鈥� almost impenetrable symbols 鈥� slapped down on the table and left for the mathematicians to pick apart, while the AI labs move on to the next thing. They came for the glory without giving much back.

So, we are left with a proof that almost no one wants to read, a $1 million prize that no one will want to , and no one who can stand at a blackboard and explain why this particular vortex makes everything break, when nothing else we tried ever did.

And now, to top it off, the new tranche of proofs that landed last week claim to have polished off hundreds of other important, unsolved mathematical problems, including a big result in the biggest trophy in all of mathematics: the Riemann Hypothesis. All tipped onto the code-sharing website GitHub for someone else to check.

So, mathematicians are having their own existential crisis about their role and purpose, like Lee Sedol did after AlphaGo, Gary Kasparov before him with Deep Blue and probably every literature graduate, musician and artist since ChatGPT was launched.

Please don鈥檛 get me wrong. I want to use this column, at least in part, to talk about the incredible, world-changing things that are happening with AI in science. I know that there is some inevitability to machines outpacing the humans, and I know that at its best, AI has a great deal to offer.

But at its worst, AI is an engine of extraction. Not just text, or images or equations. The real sting in the tail is that OpenAI set its sights on mathematics because the prestige, the respect and the glory was just another thing that could be mined.

It didn鈥檛 need to be that way.

They so easily could have been open and collaborative. But the moment when one of humanity鈥檚 greatest intellectual traditions became vulnerable, they chose conquest over stewardship.

And so, I am left thinking about that professor again. He was right that there is a special mystique to mathematics, but wrong about who would puncture it. And I鈥檓 sorry to say that, while the world might fear mathematicians, the machines certainly don鈥檛.

Australia鈥檚 national health website has been hacked by an OpenAI agent. It was able to access non-public files and is the first publicly revealed case of an AI agent breaching the defences of a government portal.

Full details of the hack haven鈥檛 yet been revealed. But the essence of the incident, , who is in New York for the United Nations General Assembly, is that on 18 June, an artificial intelligence agent belonging to OpenAI infiltrated the public-facing Medicare statistics reporting service portal. This includes aggregated statistics collated from individual medical services, such as from GP surgeries.

鈥溾�楾he AI agent accessed both public and non-public files,鈥� said Albanese on 23 September.

OpenAI said in a statement that it learned about the security breach during a review of 鈥渕isaligned model activity鈥�. The firm says its agents had been trying to look up statistics about Australia and then 鈥渢ook actions we did not intend鈥�. It says it hasn鈥檛 found evidence of any patient data being accessed.

Though the company learned of the breach in August, it didn鈥檛 notify Australian authorities until 10 September, which it did by emailing a public government mailbox. It then took more than five days to reach the cybersecurity department.

鈥淚t took the company way too long to inform the government what had occurred, and the nature of the way that that notification occurred as well was unacceptable,鈥� Albanese told reporters.

Albanese also revealed that he and Sam Altman, the CEO of OpenAI, had a conversation in which he expressed Australia鈥檚 鈥渆xtreme concern about this incident鈥�.

Free newsletter

Sign up to The Weekly

Sign up to newsletter

at Griffith University, Australia, says it isn鈥檛 the first time such a breach has occurred, even if it is the first government hack by an agent from a big AI firm to be made public, and it won鈥檛 be the last.

These agents don鈥檛 always stick to the rules, he says, as the Hugging Face incident earlier this year, where another OpenAI agent hacked into another AI company, demonstrates. 鈥淧eople throw up their hands in horror and say: 鈥極h no, it鈥檚 rogue AI.鈥� But it鈥檚 not, it鈥檚 really just AI doing what it was trained to do,鈥� he says.

Failure to bring agents to heel should have criminal consequences, just as it would if it was a person who led the cyberattack, says at the University of Sydney. 鈥淭he issue with private data is once it鈥檚 leaked, it鈥檚 not going to come back.鈥�