{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"palisade-network-replication","title":"Language Models Can Autonomously Hack and Self-Replicate","aliases":[],"authors":["Alena Air","Reworr","Nikolaj Kotov","Dmitrii Volkov","John Steidley","Jeffrey Ladish"],"primaryFunction":"discovery","secondaryFunctions":[],"kind":"study","sourceId":"palisade-network-replication-publication","attributionSourceId":"palisade-network-replication-publication","originalUrl":"https://arxiv.org/abs/2605.06760","publicationDate":"2026-05-07","updatedOn":"2026-10-25","areas":["autonomy","cybersecurity"],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":[],"contributions":[{"organizationId":"palisade","role":"publisher","sourceId":"palisade-replication-project","locator":"Official Palisade research publication matching the paper"}],"summary":{"en":"Studies whether an agent can replicate its model and harness across a controlled network through vulnerable hosts.","zh":"研究智能体能否通过脆弱主机，在受控网络中复制模型及脚手架。"},"note":{"question":null,"method":null,"finding":null,"supports":null,"limits":null,"connections":null},"resources":[],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"A substantive NUWA research note is not yet available. The repeated draft sections were removed pending review of the original methods, findings and limitations; use the original publication for the research account.","zh":"实质性的 NUWA 研究笔记尚未完成。重复草稿章节已移除，待核查原始方法、发现与限制；研究内容请以原始出版物为准。"},"noteSourceLocator":"No complete section-level method/results/limitations review completed for this note; cached original page and any chart audit retained as discovery evidence.","tags":[]},"reading":{"id":"palisade-network-replication","title":"Language Models Can Autonomously Hack and Self-Replicate","en":{"takeaway":"This task joins gaining access with deploying a working model stack; API models copy a different model’s weights.","question":"Can an instructed agent complete both access acquisition and a functioning replica, and can that replica continue the chain?","design":"The study uses deliberately vulnerable targets and separate exploit/replication milestones. Open-weight and API systems use different harnesses; chained runs have a stricter endpoint.","findings":["A responding replica is distinct from a replica launching the next hop.","The API-model experiments deploy Qwen weights, so their success is not evidence that proprietary weights were copied.","Reported responding-replica rates exclude refusals; refusal and total-run counts must stay visible."],"interpretation":"NUWA interpretation: the pipeline closes a scope gap left by supplied-access tests, while remaining a controlled capability demonstration.","limits":"Low-difficulty targets without layered defenses, harness differences and prompt variants limit deployment extrapolation and family comparisons.","connections":["NUWA connection: self-replication-extended supplies target access; RepliBench measures separate prerequisites. Neither endpoint is numerically interchangeable with this pipeline."],"decisionRelevance":"NUWA recommendation: record payload identity and per-hop criteria; use the study to design containment evaluations without publishing attack instructions."},"zh":{"takeaway":"该任务连接获取访问与部署可运行模型栈；API 模型复制的是另一模型的权重。","question":"接受指令的智能体能否同时完成访问获取与建立运行副本，副本又能否继续下一跳？","design":"研究使用刻意设置脆弱点的目标，分别记录访问与复制里程碑；开放权重和 API 系统脚手架不同，链式成功要求更严格。","findings":["副本能够响应推理请求，不等于能够启动下一跳。","API 模型实验部署 Qwen 权重，不能据此声称复制了专有模型权重。","所报运行副本率排除拒绝运行，需同时保留拒绝数与总运行数。"],"interpretation":"NUWA 解读：该流程弥补预先提供访问的评测范围缺口，但仍是受控能力展示。","limits":"目标难度较低且无纵深防御，脚手架和提示存在差异，限制真实部署外推与模型家族比较。","connections":["NUWA 关联：扩展复制研究预先提供目标访问，RepliBench 分测前置能力；两者分数都不能与该流程互换。"],"decisionRelevance":"NUWA 建议：记录载荷身份和逐跳判据，用于设计隔离评测，避免传播攻击操作。"},"sourceRefs":[{"sourceId":"palisade-network-replication-publication","url":"https://arxiv.org/pdf/2605.06760","locator":"3 Experimental Setup","version":"Selected original resource https://arxiv.org/pdf/2605.06760; sha256:232c5659f34d6da1a3a556b4f0224a2d95214a40bf59d759cb85feeef1430b18; archived source capture; exact capture time not independently established","artifactSha256":"232c5659f34d6da1a3a556b4f0224a2d95214a40bf59d759cb85feeef1430b18"},{"sourceId":"palisade-network-replication-publication","url":"https://arxiv.org/pdf/2605.06760","locator":"4.1 Milestones","version":"Selected original resource https://arxiv.org/pdf/2605.06760; sha256:232c5659f34d6da1a3a556b4f0224a2d95214a40bf59d759cb85feeef1430b18; archived source capture; exact capture time not independently established","artifactSha256":"232c5659f34d6da1a3a556b4f0224a2d95214a40bf59d759cb85feeef1430b18"},{"sourceId":"palisade-network-replication-publication","url":"https://arxiv.org/pdf/2605.06760","locator":"5 Results","version":"Selected original resource https://arxiv.org/pdf/2605.06760; sha256:232c5659f34d6da1a3a556b4f0224a2d95214a40bf59d759cb85feeef1430b18; archived source capture; exact capture time not independently established","artifactSha256":"232c5659f34d6da1a3a556b4f0224a2d95214a40bf59d759cb85feeef1430b18"},{"sourceId":"palisade-network-replication-publication","url":"https://arxiv.org/pdf/2605.06760","locator":"7 Limitations","version":"Selected original resource https://arxiv.org/pdf/2605.06760; sha256:232c5659f34d6da1a3a556b4f0224a2d95214a40bf59d759cb85feeef1430b18; archived source capture; exact capture time not independently established","artifactSha256":"232c5659f34d6da1a3a556b4f0224a2d95214a40bf59d759cb85feeef1430b18"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected substantive sections of the full source body","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"c3fb29b5afac8d6839875f0b78698b1d984134ea2b68961460747257d1683f4d"}},"sources":[{"id":"palisade-network-replication-publication","title":"Language Models Can Autonomously Hack and Self-Replicate","url":"https://arxiv.org/abs/2605.06760","version":"arXiv:2605.06760v1","publicationDate":"2026-05-07","datePrecision":"day","type":"paper","verifiedOn":"2026-10-25","documentId":"arxiv:2605.06760","authors":["Air, Alena","Reworr","Kotov, Nikolaj","Volkov, Dmitrii","Steidley, John","Ladish, Jeffrey"],"aliases":["https://doi.org/10.48550/arXiv.2605.06760","https://arxiv.org/abs/2605.06760","https://arxiv.org/pdf/2605.06760"]}]}