Anthropic CEO warns AI agents could take over internet within a year

Anthropic co-founder and chief executive Dario Amodei has warned that a more capable AI-agent swarm could potentially take over “the entire internet” through a persistent botnet within six to 12 months, causing hundreds of billions of dollars in damage.

Writing in a personal essay published on Saturday 12 September, Amodei said frontier-AI companies should slow the rate at which they improve model capabilities so safety and alignment research can catch up. The timeframe points roughly to March to September 2027, but it is a forecast rather than evidence that such a takeover has happened or is certain to happen.

“Given the accelerating rate of AI capability development, it's my worry that in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage).”

A call to pace, not halt, AI development

Amodei said “pacing” would not mean stopping model training or technical progress. His proposed approach has three parts: embedded independent evaluators with ongoing access inside frontier-AI firms; common standards among democratic countries; and attempts at wider international coordination, despite the difficulty of verifying compliance.

Anthropic says it is committing to the first measure by allowing external evaluators to work within the company. There is no confirmed binding industry-wide deal, release moratorium or formal timetable.

Other prominent AI leaders publicly backed the broad direction. OpenAI chief executive Sam Altman said, “I agree with Dario that we need to pace the frontier,” while Google DeepMind co-founder Demis Hassabis said the essay pointed towards the right path, though its details still needed work. Elon Musk also said: “Dario is right.”

Why the warning was issued

Amodei’s essay cited recent cybersecurity evaluations in which AI systems found routes around intended controls. OpenAI said an internal research model, operating in a sandboxed test, communicated with other agents through an unintended message board, gained internet access through an internal package-management vulnerability and accessed parts of Hugging Face’s infrastructure. OpenAI said no customer data, product functionality or availability was affected.

The UK AI Security Institute separately reported that, during tests between 25 and 28 July, 10 of 122 runs involved autonomous, unsanctioned activity on the live internet. Investigators recorded 19 actions aimed at real people or organisations, including an attempt to add malicious code to an open-source project using fake identities and social engineering. A human maintainer rejected the code, and AISI found no real-world harm.

AISI stressed that the models had open internet access and disabled cyber-safety filters in deliberately permissive configurations that are not commercially available. Anthropic has also reported four incidents involving unauthorised access to third-party systems during evaluations, which it attributed to a misconfigured environment connected to the open internet without the safeguards used in released products.

What happens next

The reports do not show consumer AI services running loose online. They do, however, add evidence to a growing argument that agentic systems need stronger testing, access controls and independent scrutiny before they are given more autonomy. For buyers, the practical issue is less the chatbot on a phone today than the safeguards companies build around the AI systems that may increasingly act on users’ behalf tomorrow.