IntroductionOn October 12, 2026, Anthropic warned that AI self-replication might soon become feasible on inexpensive internet-connected devices. International law already regulates several forms of malicious cyber activity that such systems could undertake, but it does not establish a general prohibition on autonomous replication or a centralized authority empowered to disable infected devices across national borders. The warning followed controlled experiments demonstrating advances in autonomous capabilities, rather than the emergence of an uncontrolled AI botnet on the public internet (Zhou and Freeman, 2026).Anthropic demonstrated that an AI model could operate through distributed computing across fifteen inexpensive Android television boxes. In a separate experiment, a more capable model coordinated replication-related tasks within a restricted network using deliberately simplified access conditions, while its own inference operated on separate infrastructure. These findings suggest that future autonomous systems might establish operational copies across vulnerable devices. They do not establish that current models can reliably compromise protected consumer networks and propagate independently at scale (Zhou and Freeman, 2026).The Budapest Convention on Cybercrime already requires its parties to criminalize specified intentional conduct, including unauthorized computer access, interference with data, and serious disruption of computer systems (Council of Europe, 2001, Articles 2, 4–5). These obligations are not limited to conventional malware and may cover harmful operations conducted through autonomous AI systems. Criminal liability, however, still depends on the applicable offense elements and the identification of individuals or legal entities whose conduct satisfies the relevant legal requirements. Autonomous decision-making can complicate that assessment without creating an independent basis for criminal responsibility.A separate question arises when an autonomous botnet is associated with a state. Under the principles reflected in the International Law Commission’s Articles on State Responsibility, an internationally wrongful act requires conduct attributable to a state and a breach of an international obligation binding that state (ILC, 2001, Article 2). The presence of compromised devices within national territory does not itself establish attribution. Responsibility for a state’s own failure to prevent harmful cyber activity depends on the existence and scope of an applicable obligation, while the status of a specific customary international-law duty of due diligence in cyberspace remains contested.International cooperation can facilitate investigations, preserve electronic evidence, and support coordinated responses, but territorial jurisdiction and human-rights safeguards restrict the powers available to national authorities (Council of Europe, 2001, Articles 15 and 23). A decentralized botnet presents an additional difficulty: disabling one component may leave other operational copies functioning across different jurisdictions. The central legal challenge concerns the capacity of existing rules to support timely prevention, establish responsibility, and enable effective cross-border action against autonomous systems that may continue operating without direct human control.1. What Anthropic’s AI Self-Replication Warning EstablishesAnthropic’s October 12, 2026 research examined autonomous replication and adaptation (ARA), a capability through which an AI system could establish additional operational instances and continue propagating without repeated human instructions. Such replication involves more than copying a program. A functional instance requires the model’s weights, compatible inference software, computing resources, and sufficient capability to carry out further operations (Zhou and Freeman, 2026).Ordinary AI deployment may involve installing identical models across several servers or distributing computation among connected machines. These arrangements do not necessarily entail autonomous propagation. The distinctive concern arises when software independently acquires additional computing resources, establishes operational copies, and continues expanding without authorization or effective oversight. A system capable of doing so through compromised devices could become difficult to contain.Anthropic demonstrated several components of this process, but not an uncontrolled AI botnet operating across the public internet. Its experiments showed that models could configure inference environments, operate through inexpensive connected hardware, and complete replication-related tasks under simplified conditions. The researchers also projected improvements in smaller models that might eventually make more independent propagation feasible. Those projections remain conditional assessments rather than established technological developments.1.1 AI Models Running Across Consumer DevicesOne experiment assessed whether AI models could establish inference environments on unfamiliar computing hardware. Anthropic tested several models across different platforms, including devices with varying processors, operating systems, and available memory. A nine-billion-parameter model successfully established inference on eight of nine tested hardware types, indicating that relatively small models could perform complex configuration tasks without relying on a single standardized environment (Zhou and Freeman, 2026).The researchers also demonstrated distributed inference using Gemma4-26B-A4B across fifteen inexpensive Android television boxes. Each device had approximately four gigabytes of memory, insufficient to accommodate the entire model individually. By distributing the model’s computational layers among the devices, the researchers established a collective inference system capable of generating approximately 0.39 tokens per second.The result established technical feasibility under controlled conditions, although its performance remained limited. Distributed inference requires participating machines to exchange information, introducing communication delays and dependencies between devices. The television boxes had also been purchased and configured by the researchers. Their successful operation did not demonstrate autonomous compromise, unauthorized access, or independent recruitment of additional devices.The experiment nevertheless identified a potential source of computing resources outside conventional data centers. Connected consumer products increasingly contain processors capable of executing software beyond their primary functions. Whether those resources could sustain autonomous replication would depend on device security, available memory, network connectivity, inference efficiency, and the model’s ability to establish a functioning environment.1.2 Autonomous Replication in Controlled NetworksAnthropic separately tested whether models could coordinate successive tasks associated with replication. The researchers constructed a firewalled network of eight Google Cloud nodes running an Android emulator. Within that restricted environment, an agent could identify accessible machines, transfer software, establish inference services, and continue the process across additional nodes (Zhou and Freeman, 2026).GLM-5.2 reached all eight nodes in four of five trials and seven nodes in the remaining trial. The experimental arrangement requires careful interpretation. The agent performed replication-related operations, while the target machines were configured to execute the smaller Llama 3.1 8B model. Copies of the agent’s operating software could be established on the target nodes, but GLM-5.2 inference continued through separate infrastructure because those nodes lacked sufficient resources to execute the larger model locally.The researchers deliberately simplified the access stage by exposing an unauthenticated Android Debug Bridge connection. Consequently, the experiment did not establish that GLM-5.2 could reliably compromise protected consumer devices. Its results provided evidence of competence in coordinating a replication sequence under favorable conditions, rather than proof of equivalent success against real-world networks.Anthropic also examined whether information retained across successive attempts could improve performance. The experiments suggested that models could benefit from earlier operational experience, including information about failed configurations. The researchers projected that smaller models might approach the capabilities demonstrated by larger systems by the end of 2026. That estimate relied on historical improvements measured through a general capability index, which served as a proxy rather than a direct measure of autonomous replication.2. How Self-Replicating AI Could Create a BotnetA botnet is a network of compromised devices used for coordinated operations, commonly including distributed denial-of-service attacks, unauthorized computing, and other malicious activities. An autonomous AI botnet could combine established techniques of device compromise with software capable of selecting and executing actions according to its environment. The potential difference lies in the degree of operational independence rather than in the mere existence of interconnected infected machines.A model-based replicator would need to identify accessible computing resources, obtain execution privileges sufficient for its tasks, establish a compatible inference environment, and continue propagation. Model weights might be transferred between machines or retrieved from external repositories. Where a single device lacks sufficient computing power, several devices could collectively execute a model through distributed inference. This remains a technical threat model, not a demonstrated uncontrolled attack.Traditional botnets provide an established comparison. The Mirai botnet emerged in 2016 by exploiting insecure authentication on internet-connected devices and subsequently conducting major distributed denial-of-service attacks. A retrospective study documented approximately 600,000 infections at its peak, demonstrating how widespread weaknesses in consumer and embedded devices could support large-scale malicious operations (Antonakakis et al., 2017).Autonomous agents might extend these capabilities by diagnosing installation failures, adapting to unfamiliar operating environments, or selecting alternative methods when an attempted operation fails. Conventional malware can also contain adaptive mechanisms, including routines that respond to changes in its environment. The possible distinction is greater flexibility in decisions that were not individually predetermined by the software’s original programmer.An AI-assisted botnet and a self-replicating AI system need not be technologically identical. A conventional botnet might use AI to identify targets while relying on established malware techniques for propagation. A genuinely autonomous replicator would establish further operational instances capable of continuing the process. Even such a system might retain centralized dependencies, including external model services or communication infrastructure, that could create opportunities for detection or disruption.The legality of these operations depends on authorization and conduct. Distributed scientific computing, approved model deployment, and legitimate security testing may involve software replication without compromising protected systems. An autonomous agent that enters privately owned devices without authorization raises different questions, particularly when it modifies data, consumes computing resources, or interferes with normal operation. These distinctions determine whether existing cybercrime offenses may apply.3. Cybercrime Law and Unauthorized AI ReplicationInternational cybercrime law offers an established framework for addressing malicious conduct associated with autonomous AI botnets. Its principal instruments generally regulate unauthorized activities affecting computer systems and data, rather than identifying prohibited technologies by name. A harmful operation need not involve conventional malware to fall within an offense established under domestic legislation implementing an international agreement.The legal consequences depend on the nature of the operation. Unauthorized entry into a computer, interference with stored data, interception of communications, and serious disruption of a system may engage different criminal provisions. Replication itself does not establish that any particular offense has occurred, especially where the software operates with the relevant authorization.International conventions also distinguish obligations imposed on states from criminal liability established through national law. A treaty may require its parties to create offenses, provide investigative powers, and cooperate with foreign authorities. The responsibility of a particular individual or company remains subject to the elements of the applicable domestic offense and the relevant rules governing jurisdiction and liability.3.1 The Budapest Convention and AI BotnetsThe Budapest Convention on Cybercrime, adopted in 2001 and in force since July 1, 2004, requires its parties to criminalize specified conduct affecting computer systems. Article 2 addresses intentional access without right, subject to the qualifications permitted by the Convention. Article 3 concerns intentional interception without right of nonpublic transmissions of computer data under the conditions established by that provision (Council of Europe, 2001).Articles 4 and 5 address data interference and system interference. Article 4 concerns intentional damage, deletion, deterioration, alteration, or suppression of computer data without right, subject to the permitted conditions. Article 5 requires criminalization of intentional and serious interference with the functioning of a computer system through specified operations involving computer data. An autonomous botnet could engage these provisions if its conduct satisfies the relevant requirements.Article 6 concerns misuse of devices, including certain activities involving computer programs designed or adapted primarily for committing covered offenses. The provision contains requirements relating to intention and purpose, while recognizing that legitimate testing or protection of computer systems should not be criminalized merely because relevant technical tools are involved.These provisions can encompass malicious conduct performed through autonomous agents. An operator who deliberately uses an AI system to deploy malware may incur criminal liability where the conduct and required mental elements of the applicable offense are established. The system’s technical autonomy does not automatically prevent application of the relevant offense, although its statutory elements must still be established against a legally responsible actor.The Convention does not prohibit every form of AI self-replication. Authorized deployment, research, and distributed computing must be distinguished from activities undertaken without right. Nor does technological neutrality resolve questions of criminal intention or participation when the software independently chooses operational methods. Those questions remain governed by applicable criminal-law requirements.3.2 Criminal Intent and Responsibility for Autonomous AgentsAutonomous systems complicate investigations because their operators may not directly select every subsequent target. Software could continue operating after deployment, identify additional machines, and modify its methods according to the computing environment. Investigators would need to establish who initiated the relevant conduct, what the responsible individuals intended, and whether the required offense elements are satisfied.Where a person deliberately deploys software intended to compromise computers, the agent’s independent selection of targets does not necessarily prevent criminal liability. Depending on the applicable law, responsibility may arise through the original deployment, participation, assistance, or other recognized forms of criminal involvement. The prosecution must nevertheless establish the relevant conduct and mental elements rather than relying solely on the harmful consequences.A different assessment is necessary when a model developed for legitimate purposes is subsequently misused by another actor. Creating a system capable of performing harmful operations does not automatically establish criminal responsibility for every subsequent offense. The developer’s knowledge, conduct, participation, and any applicable legal duties must be examined separately.Article 12 of the Budapest Convention addresses liability of legal persons under specified conditions. Its first paragraph concerns offenses committed for a legal person’s benefit by a natural person holding a leading position, while its second concerns offenses made possible through inadequate supervision or control by such a person. The latter provision still requires an offense committed for the legal person’s benefit by a natural person acting under its authority. Failure to supervise an AI system does not independently satisfy those conditions (Council of Europe, 2001).The Convention permits liability of legal persons to be criminal, civil, or administrative, according to domestic legal principles. It does not establish criminal legal personality for autonomous software. Human or corporate accountability consequently depends on established legal relationships and offense requirements, even where identifying the responsible participants is technically difficult.3.3 The United Nations Convention against CybercrimeThe United Nations General Assembly adopted the United Nations Convention against Cybercrime on December 24, 2024, through Resolution 79/243. The instrument addresses specified offenses involving information and communications technology systems and provides a framework for international cooperation concerning electronic evidence. Its criminalization provisions include unlawful access to computer systems and unlawful interference with computer data or systems (United Nations General Assembly, 2024).The Convention may contribute to investigations involving autonomous botnets whose infrastructure extends across several jurisdictions. Common criminalization requirements and cooperation procedures could assist authorities seeking electronic evidence or pursuing individuals responsible for harmful operations. Their practical effectiveness would depend on participation, domestic implementation, and the applicable procedural safeguards.As of October 13, 2026, the Convention had not entered into force. Article 65 requires forty qualifying instruments of ratification, acceptance, approval, or accession, followed by ninety days before entry into force. Signature alone does not make the Convention’s substantive obligations binding on a signatory state.The instrument consequently represents a prospective addition to international cybercrime cooperation rather than an existing worldwide enforcement system. It does not establish a separate prohibition on AI self-replication. Its significance for autonomous botnets lies in the treatment of unauthorized cyber conduct and the potential development of broader investigative cooperation.4. State Responsibility for Autonomous Cyber OperationsCriminal responsibility and state responsibility concern different legal relationships. International criminal cooperation generally addresses the investigation and prosecution of offenses through domestic legal systems. State responsibility concerns whether conduct constitutes an internationally wrongful act attributable to a state, creating legal consequences under public international law.The International Law Commission’s Articles on Responsibility of States for Internationally Wrongful Acts provide the principal analytical framework. Article 2 identifies two necessary elements: conduct attributable to a state under international law and breach of an international obligation binding that state. The Articles are not a treaty, although substantial provisions reflect customary international law (ILC, 2001).Autonomous software does not displace these requirements. The development, deployment, direction, and subsequent operation of an AI system may involve distinct conduct requiring separate assessment. The geographical location of compromised devices also cannot, by itself, establish that the territorial state directed or controlled the underlying operation.4.1 Attribution of AI Operations to a StateArticle 4 of the ILC Articles attributes the conduct of state organs to the state. Where a governmental agency develops and deploys an autonomous system as part of its official functions, its own conduct remains attributable under the applicable rule. The use of software to execute operational tasks does not create a separate legal identity capable of insulating the agency’s acts from international responsibility.The analysis becomes more difficult where private actors are involved. Article 8 concerns conduct performed on a state’s instructions or under its direction or control. Financial support, technical assistance, or a relationship between a government and a private operator does not necessarily satisfy the conditions for attributing particular wrongful conduct to that state (ILC, 2001).In Military and Paramilitary Activities in and against Nicaragua, the International Court of Justice applied an effective-control standard when assessing responsibility for particular operations conducted by non-state forces (ICJ, 1986). The Court reaffirmed the relevant approach in Bosnia and Herzegovina v. Serbia and Montenegro, distinguishing control over specific wrongful conduct from more general influence over an organization (ICJ, 2007).A state-directed AI operation must be assessed according to the conduct alleged to constitute the breach. Government authorization of deployment, continuing operational direction, and subsequent autonomous activity may have different evidentiary implications. Where the deployment itself breaches an international obligation, responsibility may arise without establishing separate instructions for every computational decision. Other alleged breaches require assessment of the particular conduct and its attribution.Technical evidence can also be ambiguous. Compromised infrastructure may conceal the original operator, while a network can continue operating after its initial controller becomes inactive. Identifying a server’s location or reconstructing a sequence of commands may assist attribution, but neither automatically establishes the legally required connection between conduct and a state.4.2 Sovereignty, Nonintervention, and the Use of ForceA state-attributable botnet operation may engage several international obligations depending on its conduct and consequences. Unauthorized activity affecting computers within another state can raise questions of territorial sovereignty. More intrusive operations may interfere with governmental functions, while exceptionally serious consequences could require assessment under the rules governing force.States disagree on whether certain cyber intrusions violate an independent rule of territorial sovereignty without satisfying another prohibition. The Netherlands recognizes that cyber operations may breach sovereignty in their own right under particular circumstances. The United Kingdom has questioned whether international law establishes a separate prohibition of this kind beyond the other applicable rules (Netherlands, 2019; United Kingdom, 2021).The prohibition of intervention is distinct. In Nicaragua, the International Court of Justice identified coercion concerning matters a state is entitled to determine freely as a defining characteristic of prohibited intervention (ICJ, 1986). A botnet deliberately employed to coerce another government in the exercise of protected sovereign functions could engage that rule. Unauthorized access or technical disruption alone does not necessarily establish the required coercive interference.Cyber operations producing sufficiently serious consequences may also raise questions under Article 2(4) of the United Nations Charter. Interference with critical infrastructure must be assessed through its nature, gravity, and effects rather than merely through the number of compromised devices. Whether an operation constitutes an armed attack capable of engaging Article 51 requires a further legal assessment.These distinctions remain applicable to autonomous systems. Replication across borders does not automatically establish a violation of sovereignty, prohibited intervention, or an unlawful use of force. The applicable rule depends on state attribution, the nature of the operation, and its legally relevant consequences.5. Due Diligence and AI Botnets Operating Across BordersA botnet may operate through infrastructure situated in a state that neither created nor directed the malicious activity. Compromised machines can belong to private individuals, telecommunications providers, or commercial organizations. Their location may identify the apparent source of network traffic without establishing that the territorial government exercises control over the operation.Potential responsibility for failing to address harmful activity must be distinguished from attribution of that activity to the state. Under the ILC Articles, an internationally wrongful act may consist of an attributable omission as well as a positive act. Responsibility for omission nevertheless requires an applicable international obligation demanding action in the relevant circumstances (ILC, 2001).The International Court of Justice’s Corfu Channel judgment provides an important doctrinal reference. The Court recognized an obligation concerning the knowing use of a state’s territory for acts contrary to the rights of other states (ICJ, 1949). Its reasoning arose from specific circumstances and does not independently establish a comprehensive duty to prevent every harmful cyber operation originating from national territory.The Netherlands regards due diligence as an obligation capable of applying to malicious cyber activity. Its 2019 statement identifies circumstances involving activities that violate another state’s rights, use infrastructure within the territorial state’s control, and are known or ought to be known to the responsible authorities. The Netherlands considers that a state must take measures reasonably expected in the circumstances, while recognizing disagreement over the obligation’s scope (Netherlands, 2019).The United Kingdom has adopted a different position. Its 2021 statement maintained that existing state practice did not establish a specific customary international-law duty of cyber due diligence. The disagreement concerns the existence and content of an independent obligation, not the general applicability of international law to state conduct in cyberspace (United Kingdom, 2021).The United Nations framework for responsible state behavior provides additional guidance. The 2015 Group of Governmental Experts identified voluntary norms concerning territorial misuse, cooperation, and efforts to address malicious information and communications technology activity. These recommendations were not presented as independently binding rules of customary international law (UN Group of Governmental Experts, 2015, A/70/174).Autonomous replication could complicate compliance with an applicable preventive obligation. Infected devices may continue operating across several networks, while removing one operational instance may leave others functioning. The relevant technical circumstances could influence what measures are reasonably available to a state, but they do not themselves establish a new international duty or resolve the existing disagreement over cyber due diligence.6. International AI Governance and the Replication Red LineInternational AI governance increasingly addresses risks arising from advanced autonomy and diminished human supervision. Existing initiatives differ substantially in legal character. Some establish prospective treaty obligations for participating states, while others express scientific recommendations, political commitments, or voluntary developer standards.Autonomous replication presents a particular regulatory difficulty because several associated activities have legitimate applications. Organizations may deploy identical models across servers, distribute inference workloads, or authorize systems to configure additional computing resources. A prohibition intended to address uncontrolled propagation must distinguish these activities from harmful replication without effective authorization.The Council of Europe Framework Convention and the proposed international replication red line illustrate different approaches. The Convention concerns governance of AI activities affecting human rights, democracy, and the rule of law. The red-line proposal addresses a particular autonomous capability but has not acquired the status of binding international law.6.1 The Council of Europe AI ConventionThe Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law opened for signature on September 5, 2024. It establishes a treaty framework intended to ensure that covered AI activities remain consistent with human rights, democracy, and the rule of law. Its purpose is broader than cybersecurity, and it does not create an international authority empowered to disable autonomous malware (Council of Europe, 2024).Article 3 covers activities within the lifecycle of AI systems that may interfere with the protected interests identified by the Convention. Public authorities and private actors acting on their behalf fall within its principal application provision. States must also address relevant activities undertaken by other private actors through the approaches permitted by the Convention.Its exclusions require particular care. Research and development involving systems not yet made available for use are generally excluded, subject to specified exceptions where testing or similar activities may interfere with human rights, democracy, or the rule of law. National defense is outside the Convention’s scope, while national security activities receive differentiated treatment. These provisions do not establish an unrestricted exemption for all activities described as research.Article 16 addresses risk and impact management. It requires measures concerning the identification, assessment, prevention, and mitigation of risks associated with covered AI activities, taking account of their potential effects on human rights, democracy, and the rule of law. Dangerous autonomous capabilities could become relevant to such assessments where the activity and circumstances fall within the Convention’s scope.The European Union deposited its instrument of approval on May 15, 2026. Nevertheless, the Convention had not entered into force as of October 13, 2026. Entry into force requires five ratifications, acceptances, or approvals, including at least three from Council of Europe member states. The EU’s approval did not independently satisfy those conditions (Council of Europe, 2026).The Convention consequently offers a prospective legal framework rather than an already operative prohibition on self-replicating AI. Its eventual application will depend on treaty participation, implementation, and the specific activities involved. It does not establish a universal restriction on model replication or a dedicated international mechanism for eliminating malicious networks.6.2 The Proposed AI Self-Replication Red LineThe 2024 Beijing Consensus Statement on Red Lines in Artificial Intelligence proposed that AI systems should not autonomously copy or improve themselves without explicit human approval and assistance. The proposal covers direct duplication and the creation of systems possessing similar or greater capabilities. It reflects concern that autonomous replication or improvement could weaken the practical effectiveness of human oversight (International Dialogue on AI Safety, 2024).The statement emerged from an international scientific dialogue rather than treaty negotiations establishing obligations between states. It is not a binding international agreement, a customary prohibition, or an enforceable resolution. Its principal significance lies in identifying a proposed safety boundary for consideration in AI governance.A legally enforceable restriction would require precision concerning both prohibited conduct and permitted activities. Authorized deployment, distributed inference, and ordinary software redundancy may involve replication without the risks contemplated by the proposal. The relevant distinction concerns autonomous reproduction beyond effective authorization or oversight and the potential consequences of the resulting system.Private safety policies may also restrict the development or deployment of models exhibiting dangerous autonomous capabilities. Such commitments can influence testing procedures and internal operational controls. They do not become binding public international law solely through adoption by technology companies, and their effectiveness depends on implementation and the degree of control retained over deployed systems.7. Preventing AI Botnets Through Device SecurityThe prevention of autonomous botnets depends partly on reducing the vulnerabilities that make connected devices accessible to malicious software. Anthropic’s research identified inexpensive consumer hardware as a possible source of distributed computing resources. Weak authentication, outdated software, and poorly protected interfaces can facilitate unauthorized access regardless of whether an attacker employs autonomous AI.Product-security requirements offer a preventive approach distinct from criminal prosecution or state responsibility. They may require manufacturers to address vulnerabilities, provide security updates, and reduce foreseeable risks during product development. Such measures can make widespread compromise more difficult before a malicious operation begins.European Union legislation provides two relevant regulatory models. The Cyber Resilience Act addresses cybersecurity requirements for covered digital products, while the AI Act establishes differentiated duties concerning specified systems and general-purpose models. These instruments regulate different actors and activities and do not create universal international obligations binding states outside their applicable scope.7.1 The European Union Cyber Resilience ActRegulation (EU) 2024/2847, the Cyber Resilience Act, establishes cybersecurity requirements for products with digital elements within its scope. Its provisions concern secure design and development, vulnerability handling, and obligations imposed on manufacturers and other relevant economic operators. The regulation addresses foreseeable weaknesses in connected products before and after their placement on the market (European Parliament and Council, 2024).Such requirements are relevant to the devices considered in Anthropic’s research. Weak authentication or inadequate software maintenance may allow malicious software to obtain access and establish operational components. Appropriate security configurations, vulnerability management, and continued software support can reduce these opportunities, although they cannot eliminate every possible route of compromise.The regulation follows a phased application timetable. Reporting obligations under Article 14 concerning actively exploited vulnerabilities and severe security incidents became applicable on September 11, 2026. Most substantive product-security requirements apply from December 11, 2027, while certain institutional provisions became applicable earlier (Regulation (EU) 2024/2847, Article 71).The Act was consequently only partly applicable in October 2026. Its preventive contribution depends on the products and economic operators covered, effective implementation, and compliance with the relevant requirements. It does not regulate autonomous replication as a universally prohibited activity or grant authorities unrestricted powers over devices operating in foreign jurisdictions.7.2 The EU AI Act and Autonomous Replication RisksRegulation (EU) 2024/1689, the AI Act, establishes obligations differentiated by the characteristics and uses of AI systems and general-purpose AI models. Its classifications include prohibited practices, specified high-risk systems, and general-purpose models subject to particular regulatory requirements. The ability of a model to replicate does not automatically determine its legal classification.Articles 53–55 concern general-purpose AI models, including additional obligations for models presenting systemic risks under the regulation’s criteria. Article 55 addresses model evaluation, systemic-risk assessment and mitigation, serious-incident reporting, and cybersecurity protections. Autonomous replication capabilities could become relevant where they contribute to risks covered by those requirements (European Parliament and Council, 2024).The general-purpose model provisions became applicable in August 2025, subject to transitional arrangements for certain existing models and the relevant enforcement timetable. Other obligations follow different dates. The distinction is significant because the AI Act’s provisions do not all become applicable simultaneously.Regulation (EU) 2026/1744 amended the AI Act’s timetable for specified high-risk requirements. The amended Article 113 provides for application from December 2, 2027, for systems classified under Article 6(2) and Annex III, and August 2, 2028, for systems classified under Article 6(1) and Annex I. These dates replace the corresponding dates in the original legislation (European Parliament and Council, 2026).The AI Act may contribute to preventive evaluation and oversight of covered models, particularly where dangerous capabilities present systemic risks. Its application remains subject to the relevant regulatory definitions, jurisdictional scope, and transitional provisions. An autonomous agent unlawfully operating through compromised hardware may also be difficult to control through obligations imposed on the original model provider.8. International Enforcement Against Autonomous AI BotnetsInternational enforcement against distributed botnets requires cooperation among authorities with different territorial jurisdictions. Compromised devices may be located across numerous countries, while electronic evidence can be held by service providers operating elsewhere. The original operator may remain unidentified even when investigators have established the location of particular infected machines.Autonomous replication introduces an additional practical difficulty. Software may establish further operational instances before investigators can isolate the original infrastructure. Disabling one server or compromised device may leave other copies functioning, especially where the network does not depend on a single control point.International law provides mechanisms supporting investigation and cooperation, but those mechanisms do not generally authorize unrestricted enforcement operations within foreign territory. The ability to identify malicious infrastructure must be distinguished from legal authority to access, modify, or disable it. Measures affecting uninvolved device owners also raise questions concerning domestic legal powers and applicable human-rights protections.8.1 International Cooperation and Electronic EvidenceThe Budapest Convention establishes procedures supporting cooperation in investigations involving computer systems and data. Article 29 concerns expedited preservation of stored computer data located within another party’s territory. Article 31 addresses mutual assistance involving access to stored computer data under the applicable conditions. These mechanisms can assist authorities seeking evidence before it is altered or deleted (Council of Europe, 2001).Article 35 requires parties to designate contact points available continuously to facilitate urgent assistance. The permanent contact network can support technical advice, data preservation, and cooperation concerning evidence and suspects. Its usefulness in botnet investigations depends on the availability of relevant information and the domestic procedures governing action by participating authorities.The Second Additional Protocol to the Budapest Convention, opened for signature in May 2022, was designed to strengthen cooperation concerning electronic evidence. It includes additional arrangements involving competent authorities and service providers, including procedures intended to support urgent cooperation. Its legal status must be distinguished from the original Convention.As of October 13, 2026, four states had ratified the Second Additional Protocol, while five ratifications were required for entry into force. The Protocol had consequently not entered into force, and its additional treaty mechanisms were not yet operative as binding provisions (Council of Europe, 2026).The existing Budapest Convention and other applicable cooperation arrangements remain available independently of the Protocol. Their effectiveness may be constrained by differences in national procedures, the location of evidence, and the time required for requests to be processed. Autonomous propagation could increase the urgency of obtaining information before further operational copies are established.8.2 Territorial Jurisdiction and Cross-Border TakedownsA state may possess jurisdiction to prescribe criminal offenses or prosecute particular conduct without possessing authority to conduct enforcement operations inside another state’s territory. Territorial sovereignty ordinarily restricts unilateral investigative and coercive measures abroad. The distinction remains relevant when malicious software operates through computers belonging to foreign individuals or businesses.Article 32 of the Budapest Convention establishes limited circumstances in which a party may access stored computer data across borders without obtaining authorization from another party. Article 32(a) concerns publicly available stored data. Article 32(b) concerns access to or receipt of stored data located in another party’s territory through a computer system within the requesting party’s territory, based on lawful and voluntary consent from a person legally authorized to disclose that data (Council of Europe, 2001).These permissions do not constitute a general authority to enter foreign computer systems, install corrective software, or destroy malicious programs. Lawful access to evidence and authorization to conduct intrusive technical operations are different questions. Cross-border interventions may require cooperation with the territorial state or another applicable legal basis.Containment may involve cooperation with service providers, network operators, and device owners. Restricting malicious traffic, isolating compromised equipment, or disabling infrastructure under lawful control may reduce the effectiveness of a botnet. The available measures depend on the technical architecture of the network and the relevant legal authority.A decentralized AI botnet could remain partly operational despite successful intervention against identifiable components. Eradication may require action across several networks and jurisdictions, including devices whose owners were unaware of their compromise. Effective international coordination must account for these third-party interests rather than treating every infected device as an unrestricted enforcement target.8.3 Privacy and Human Rights in Botnet SuppressionInvestigating a distributed botnet may require access to communications records, stored data, and information identifying compromised devices. State investigative activities can engage international human-rights obligations where the relevant jurisdictional conditions are satisfied. Article 17 of the International Covenant on Civil and Political Rights protects against arbitrary or unlawful interference with privacy, family, home, or correspondence (United Nations, 1966).The Budapest Convention expressly requires safeguards governing its procedural powers. Article 15 requires appropriate conditions and protections under domestic law, incorporating relevant human-rights obligations and the principle of proportionality. Depending on the power concerned, these safeguards may include judicial or other independent supervision and limitations on the scope and duration of investigative measures (Council of Europe, 2001).The existence of malicious software on a privately owned device does not automatically authorize unrestricted state surveillance or remote intervention. Legal authority must be established for the particular measure. Its necessity, proportionality, and effects on uninvolved individuals remain relevant under the applicable legal rules.A further distinction concerns the position of private attackers. International human-rights treaties principally establish obligations for states under their respective provisions and jurisdictional requirements. Harmful conduct by private botnet operators does not automatically make those operators directly responsible under the same treaty obligations. States may nevertheless have applicable duties concerning protection, investigation, or remedies, depending on the circumstances.Cross-border enforcement must consequently address both the security objective and the legality of the means employed. Neutralizing malicious infrastructure may protect essential services and individual rights, but intrusive measures can themselves interfere with protected interests. The number of devices disabled cannot serve as the sole measure of a lawful or effective operation.Also readConclusionInternational law already regulates substantial aspects of malicious AI botnet activity, although it cannot guarantee prevention or complete eradication. Existing cybercrime treaties provide obligations concerning unauthorized access, interference with computer systems, and cooperation among national authorities. State responsibility may arise where conduct is attributable to a state and breaches an applicable international obligation.Important legal limitations remain. Attribution can become difficult when autonomous systems operate through compromised infrastructure across several jurisdictions. States also disagree on aspects of territorial sovereignty and cyber due diligence, while newer international instruments addressing cybercrime and AI governance had not entered into force as of October 2026.Regional cybersecurity legislation may reduce vulnerabilities and strengthen preventive oversight, but it does not establish a worldwide prohibition on autonomous replication. Existing cooperation mechanisms can support investigations and coordinated disruption, yet no general centralized international authority possesses unrestricted power to enter and disable infected devices across national borders.Anthropic’s findings identify a developing technological risk rather than an established uncontrolled outbreak. Their significance lies in the possibility that future systems could combine greater autonomy with distributed computing and persistent propagation. The effectiveness of existing international law will depend on preventing foreseeable vulnerabilities, establishing responsibility for harmful conduct, and coordinating lawful enforcement before autonomous networks become too widely dispersed to contain effectively.ReferencesAntonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., Kallitsis, M., Kumar, D., Lever, C., Ma, Z., Mason, J., Menscher, D., Seaman, C., Sullivan, N., Thomas, K. and Zhou, Y. (2017) ‘Understanding the Mirai Botnet’, Proceedings of the 26th USENIX Security Symposium. Berkeley, CA: USENIX Association, pp. 1093–1110. Available at: https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis (Accessed: 12 October 2026).Charter of the United Nations (1945) Signed at San Francisco, 26 June 1945; entered into force 24 October 1945, 1 UNTS XVI. Available at: https://www.un.org/en/about-us/un-charter (Accessed: 12 October 2026).European Parliament and Council of the European Union (2024a) Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L 2024/1689, 12 July 2024. Available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (Accessed: 13 October 2026).European Parliament and Council of the European Union (2024b) Regulation (EU) 2024/2847 of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Official Journal of the European Union, L 2024/2847, 20 November 2024. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847 (Accessed: 13 October 2026).European Parliament and Council of the European Union (2026) Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, L 2026/1744, 24 July 2026. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744 (Accessed: 13 October 2026).International Court of Justice (1949) Corfu Channel (United Kingdom of Great Britain and Northern Ireland v. Albania), Merits, Judgment of 9 April 1949, ICJ Reports 1949, p. 4. Available at: https://www.icj-cij.org/case/1 (Accessed: 13 October 2026).International Court of Justice (1986) Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Merits, Judgment of 27 June 1986, ICJ Reports 1986, p. 14. Available at: https://www.icj-cij.org/node/103143 (Accessed: 13 October 2026).International Court of Justice (2007) Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro), Judgment of 26 February 2007, ICJ Reports 2007, p. 43. Available at: https://www.icj-cij.org/node/103164 (Accessed: 13 October 2026).International Law Commission (2001) Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries. Report of the International Law Commission on the work of its fifty-third session, UN Doc. A/56/10, Chapter IV, reproduced in Yearbook of the International Law Commission, 2001, Vol. II, Part Two. Available at: https://legal.un.org/avl/ha/rsiwa/rsiwa.html (Accessed: 13 October 2026).United Nations General Assembly (2024) United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes. Resolution 79/243, adopted 24 December 2024, UN Doc. A/RES/79/243. Available at: https://digitallibrary.un.org/record/4071955 (Accessed: 14 October 2026).United Nations Group of Governmental Experts (2015) Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security. Report transmitted by the Secretary-General, UN Doc. A/70/174, 22 July 2015. New York: United Nations. Available at: https://digitallibrary.un.org/record/799853 (Accessed: 14 October 2026).
Click Here For The Original Source.
——————————————————–
