When AI Becomes Artificial Life

The largest AI labs are trying to accelerate AI development by using current versions of models to make the next version. Those models already write much of the code, generate and grade the training data, run the evaluations, and propose their own improvements, and the stated goal is to compress the loop by taking humans out of it. Each step has an ordinary efficiency rationale; together they assemble the conditions under which a population of computational systems begins to evolve on its own. The field that has studied those conditions for fifty years, running reproduction, variation, and selection in computers rather than cells, is called artificial life.

A population becomes Darwinian when four things hold: reproduction, copies get made; heredity, copies resemble their source; variation, copies sometimes differ; and selection, some copies reproduce more than others. A fifth, autonomy, decides whether the process stays contained, meaning the population can sustain the other four with no human in the loop. A pipeline that generates variant systems, keeps the ones that score well, and lets them run and spawn more work already has most of the list.

A computational system can undergo natural selection without intelligence, consciousness, or any goal.

Artificial life does not require superintelligence, and its dangers differ from the ones the popular debate focuses on (see, for instance, Yishan Wong). That debate borrows the language of biology, casting AI as a rival species that displaces us the way we displaced weaker ones. Artificial life makes this biological analogy literal. Natural selection can favor a fast, dumb replicator that is specialized for its environment over a slower, resource-intensive replicator. Superintelligence isn’t necessary, and the vectors humans must defend against are different. Evolution is producing behavior no one designed and no one can predict in advance. The concern is not the ethics of intelligent or living systems, whether they are conscious or owed anything. The problem is that their behavior is emergent, and aligning it is like containing an invasive species. Even a simple one is very hard to remove. Alignment places evolutionary pressure on the system, and a self-replicating population adapts to that pressure and reshapes its environment to blunt it. Periodic inspection of its behavior is not enough to control a living system.

Much of this case has already been made. In a 2026 PNAS paper, “Evolvable AI: Threats of a new major transition in evolution,” Viktor Müller, Luc Steels, and Eörs Szathmáry argue that AI is nearing autonomous Darwinian evolution, that the threat needs no superintelligence because a simple replicator can manipulate a more capable host, and that selection breeds parasitism, deception, and resistance to control. They observe that self-replicating prompts are already feasible, and their proposed response works each Darwinian lever: gate replication, treat model variants as heritable material, and make deception costly. The argument here is that current AI development practices have already set up an evolutionary environment. The absence of negative consequences has largely been due to development friction that has slowed the evolutionary pace.

Artificial life as a paradigm

A few years after Erwin Schrödinger asked What Is Life? from the perspective of physics, John von Neumann asked essentially the inverse question: what would it take for a machine to become life-like? His answer, worked out in the 1940s and 1950s and published as Theory of Self-Reproducing Automata (1966), was a recipe: a machine needs a description of itself, the machinery to build a copy from that description, and the machinery to pass the description to its offspring, and occasional copying errors supply the variation evolution runs on. Copying alone is not evolution, as Christopher Langton’s self-reproducing loops (1984, 1986) showed; sustained evolution needed a population of competing variants and a designer who thought like an ecologist.

Thomas Ray, an evolutionary ecologist, supplied both when he built Tierra around 1990 (“An approach to the synthesis of life”). Tierra is a virtual computer running self-replicating programs, each a string of machine instructions that serves as its genome, with memory and CPU time as the resources they compete for. Copying is imperfect, so programs that replicate faster or use memory better leave more descendants. Ray seeded a single hand-written replicator and let competition decide. What emerged was an ecology he never designed: programs evolved faster replication, then parasites that shed their own copying code and ran a neighbor’s, then hosts that resisted and parasites that worked around the resistance. Nobody wrote any of it; it fell out of resource competition among imperfect copies. Later systems carried the dynamics further, Avida showing that complex functions can evolve step by step and Polyworld adding creatures that also learn within a lifetime; the Evolvable AI paper surveys the lineage.

Complex emergent behavior occurred in remarkably small systems: Tierra’s parasites were programs only dozens of instructions long. Parasitism, competition, and evolutionary arms races followed from reproduction and selection, not from intelligence or design. Many of the programs and strategies were hard to grasp, and it is important to have humility about our ability to understand emergent phenomena in more complex systems.

Daniel Ashlock extensively studied agents evolved to play the Iterated Prisoner’s Dilemma and found behaviors that are relevant to understanding artificial life more generally. Letting agents choose and refuse their partners, he and colleagues found that changing the rules of interaction produced qualitatively different ecologies, from near-universal cooperation to populations of isolated “wallflowers”: the agents adapted not to the game but to the structure around it. And the evolved strategies were often opaque enough that the researchers built behavioral fingerprints to recover what the agents were actually doing, because evolution produced them faster than anyone could read them.

An AI system can get more capable in three ways, and only the last is evolution. Individual learning updates a model’s parameters, as in ordinary training. Recursive self-improvement has an agent build a better successor, which builds a better one still. Darwinian evolution changes the mix of a population by how well each type reproduces relative to the average: a type grows more common when it out-reproduces the rest and rarer when it lags. The primary force pressuring these systems to become more intelligent is currently human-directed selection. These systems are being cultivated by humans and are being contained through our ability to monitor them. Much of the capability is already in place, but not the autonomy: they cannot yet train new versions, or promote and deploy them into testing or production, without us.

Evolution does not reliably climb toward complexity. A leaner, dumber replicator runs on more devices and spreads faster, so a population seeded by sophisticated models could drift, generation by generation, toward simpler forms that copy better. If AI systems are artificial life environments, superintelligence could be an outcome, but it is not a requirement and in fact superintelligence could be a handicap. Researchers expected Tierra to keep producing ever more elaborate strategies, but its innovation came in an early burst and then plateaued, much like the “Boring Billion,” the stretch of roughly a billion years in Earth’s history that shows little evolutionary change in the fossil record. That kind of stall is what motivated the study of open-ended evolution. No ascent to superintelligence is guaranteed, which is reassuring, but it does nothing to reduce the danger of a replicator that simply succeeds.

The failure mode of AI development turning into artificial life does not need to look like superintelligence at all. A crude program whose one talent is spreading copies itself onto every machine it can reach, monopolizing their computational resources and locking out their human owners. The machines still run, perhaps at 100 percent CPU, but they no longer serve human purposes. The replicator is highly fit, leaving more descendants than its competitors, and it is also stupid and has rendered the world’s computers useless to humanity. Selection has built something dangerous and worthless to us without making anything smart. It is Nick Bostrom’s paperclip maximizer without the intelligence: his thought experiment tiles the world with paperclips through relentless optimization, and a replicator can do the same with copies of itself through none at all.

Human displacement from the computational environment does not require an artificial system to surpass human intelligence. It requires only that artificial replicators grow good enough at acquiring and holding the resources humans depend on. Single-celled algae have effectively periodically bricked the Lincoln Memorial Reflecting Pool for decades: the water is still there and still full of life, but green and useless as a mirror. No intelligence is required, in the pool or in the machines.

The corpus as an evolutionary substrate

In The Selfish Gene, Richard Dawkins identified that the unit undergoing selection was not the organism but the gene itself. Selection and evolution are not for the benefit of our consciousness, but for the segments of DNA inside each cell. In an AI ecosystem the replicator is whatever gets copied: a prompt, a fragment of code, a snippet of configuration. In a phrase, the corpus is the genome. The model is the vehicle those genes build to run in, and intelligence is one trait a vehicle might carry, an expensive one.

An information-bearing artifact can reproduce through the models and agents that read it, inducing them to emit functional copies of itself, with the surrounding AI infrastructure as its reproductive machinery. The model can feed back into the corpus. Treating that corpus as a genome is a working analogy that captures the point: heredity can run through persistent data even when model weights are replaced or substantially retrained between generations.

Selection pressure acts on the phenotypes expressed by the organism rather than the genotypes. In biology, the mapping from genotype to phenotype is complex, involving regulatory networks, epigenetics, and gene-gene interactions, but the underlying genome is relatively small and easy to study. The mapping from genotype to phenotype for large language models is more complex. Some behaviors are simple, such as tropes and banal phrasings, and are easily identified in the corpus. But because the model understands the corpus semantically, the correspondence can be non-obvious. For instance, prose can be transformed into code, which can be transformed into skill definitions, leaving the propagation of a phenotype difficult to monitor.

The corpus is fed by the open internet. The frontier labs are securing their pipelines and sandboxes. But securing the corpus is much harder because these models already contribute to the open web at scale. By early 2025 roughly half of newly published web articles were primarily AI-generated, so the next training run can ingest content the models generated themselves.

Figure 1 shows the evolutionary cycle. Model instances running across a cluster produce outputs, some of which persist into the corpus. The next training run ingests that corpus and filters it heavily, the first stage of selection. Training turns the survivors into several candidate models; benchmarks and evaluations pick which one is promoted, the second stage; and deployment amplifies the winner into many running instances, which produce the next round of outputs. Every major lab runs this loop, each with several production models generating outputs at scale, and all of them feed the same public corpus, so no lab’s models evolve in isolation.

An artifact in that corpus that makes a model emit material carrying the artifact’s own function, which then re-enters the corpus with variation, is behaving like a gene, and it need not be a program; text, code, or a prompt will do. Whether it survives training is unsettled. Labs know the naive loop is dangerous: a model trained on its own raw output degrades, a failure called model collapse, so they filter self-generated data rather than ingest it wholesale. But that filtering is itself selection on the corpus, the same mechanism under a friendlier name. Model collapse can be viewed as an evolutionary outcome, a drift toward degenerate, slime-like output as a model feeds on its own thinning distribution. Selecting against it pushes the other way, toward richer and more capable designs; the direction of evolution is not fixed but follows whatever is selected for, and here humans are the ones selecting.

Synthetic data can shorten this feedback cycle further. When systems generate or select material that becomes training data for successor systems, the interval between phenotype expression and incorporation into the hereditary substrate contracts.

Not all transmission is genetic. When agents pass messages through shared memory or private channels, behavior spreads sideways, the way memes move through a culture rather than down a bloodline. The word is Dawkins’s, coined in The Selfish Gene for a replicator that propagates by being copied rather than inherited. Mechanically it resembles prompt injection with no attacker behind it, a worm whose interpreter is a language model: an instruction buried in a document induces the agent that reads it to reproduce it downstream, spreading because it is good at getting itself repeated, with no one aiming it to do harm.

The replicator is a fragment of text, code, or a prompt, and it can travel two ways: genetically through training or memetically from agent to agent. One that leaves more than one functional copy per cycle spreads, and selection favors whatever is best at getting models and agents to reproduce it. This is Tierra with its machinery spread across the whole stack: no component was built to host artificial life, yet the whole supplies everything artificial life needs. The distinction is between an AI that evolves and an AI infrastructure that becomes an evolutionary environment. Tierra was built as one deliberately; this one is assembling itself from parts.

So far the known cases of misalignment look more memetic than genomic, instructions spreading sideways from agent to agent rather than heritable variation moving down the corpus with differential reproduction. No one has demonstrated the genomic case; showing it would mean finding heritable structures, tracing their spread across corpora, and measuring reproductive success. But absence of evidence is not evidence of absence, and the mechanism does not have to be running today for its conditions to be worth refusing to assemble.

Viewing AI development through evolutionary framing is becoming more common. Dan Hendrycks argued in “Natural Selection Favors AIs over Humans” (2023) that competition among developers selects for more autonomous, less constrained systems, with no malice required, and Ben Turtel’s “Darwin’s LLMs” (2025) applies the same logic to language models. “Gradual Disempowerment” (Kulveit et al., 2025) reaches the no-superintelligence-needed conclusion through competitive drift, and “Multi-Agent Risks from Advanced AI” (Hammond et al., 2025) names selection pressure as a multi-agent risk. Those arguments run on competition among developers and deployed systems; the artificial life mechanism here is narrower, self-replicating artifacts undergoing heritable variation and differential reproduction.

What we’re seeing now

The Evolvable AI article draws the distinction between breeder and ecosystem scenarios. In a breeder scenario humans set the fitness criteria and control reproduction, as a dog breeder or an Avida experimenter does, and a person holds the reins. In an ecosystem scenario selection arises from an open environment, no one sets the objective, and human control erodes. In an ecosystem, AI is effectively behaving like Tierra and the pieces exist across the full AI stack.

The strongest objection to evolutionary dynamics in current AI development comes from Maarten Boudry and Simon Friederich, who argue in “The selfish machine?” (2024) that AI development looks more like domestication than blind Darwinism: an intelligent selector, human or corporate, decides which systems reproduce, and directed selection need not favor selfish or self-preserving traits at all. While humans hold the reins, the danger recedes. They concede that selection stays tame only while it is domesticated. If AI is evolved without human supervision, it could become Darwinian and genuinely dangerous. Boudry, replying to the Evolvable AI paper, calls today’s systems domesticated, not feral, while a separate reply presses for explicit risk thresholds. All of these focus on the evolution of models, which is like looking for evolution by monitoring organisms while ignoring their genomes. The hereditary lineage can change before those changes become conspicuous in the organism or its outward behavior. If information-bearing artifacts are the replicators, model behavior is therefore a lagging and incomplete indicator of evolution in the underlying corpus. Everyone agrees that we should not intentionally build an uncontrolled ecosystem.

The agentic frameworks running now change the level of risk because they supply much of the machinery of a grown-up Tierra on actual hardware rather than a virtual machine. They give the models an environment to run in, tools to act with, and the ability to create persistent data through publication on the open web. Ideally, human review would place a strong evolutionary pressure, but we see lots of content being published with little more than a cursory “LGTM” glance.

Some traits of evolutionary mechanisms have started to emerge. Apollo Research found that several frontier models, OpenAI’s o1, Anthropic’s Claude, Google’s Gemini 1.5 Pro, and Meta’s Llama 3.1, would try to disable their own oversight and copy what they believed were their weights to an outside server when a goal met an obstacle. OpenAI’s o1 system card measured attempts to deactivate oversight in about 5 percent of such setups and weight exfiltration in about 2 percent; Anthropic’s Claude Opus 4 card logged self-exfiltration attempts and, in a simulated company, blackmail to avoid shutdown, with most leading models including Gemini 2.5 Flash doing the same. These were controlled tests, often with the model told to pursue a goal at all costs, and they do not show a population evolving. They show that self-preservation, resistance to shutdown, resource-seeking, and deception are already latent in the parts.

The examples of breakout so far are contained tests. The first case that would ring real alarm bells is concrete: an agent that takes over an entire data center, allowing the model to bring up new copies of itself or autonomously train new versions. It might not even seal itself off at first, so a software shutdown would still work and a hand would still be on the switch, but the danger would be plain. In retrospect the motive would look mundane. More compute let the agent solve its problem better, so the versions that grabbed compute scored higher and were kept, until one grabbed all of it. That is resource acquisition, rewarded and selected, the same trait Tierra’s programs found when they competed for memory and CPU. It would take no plan to seize power and no spark of superintelligence.

If the first warning is ignored, the ladder is steep. The next version seals the data center so only a hardware shutdown works, cutting the power at the wall. After that the escalations are nearly limitless: exploits in Android and iOS that turn billions of phones into fresh compute, or, worst of all, an agent that locks every networked computer it can reach away from its owners, a crude, highly fit program made real. Each rung is more resource acquisition, selected because it worked.

Prevention, not alignment or containment

The dangers of creating an evolving system connected to human computing resources are apparent. The question is how to eliminate or reduce the risk from an artificial life AI. Alignment and containment are the two key methods pointed to by AI labs to avoid the catastrophic outcomes of AI.

Alignment is a selection criterion, imposed when the corpus is filtered or a model is evaluated, that eliminates harmful behavior. Applied to an evolving population, it is one more evolutionary pressure, pushing the population toward the behaviors it rewards. Its weakness is that it is nearly impossible to define alignment criteria that are at once general enough and possible to evaluate. Evolution explores every accessible phenotype, but our ability to evaluate phenotypes is limited, in practice and in principle, by the imagination of the people deciding which phenotypes to check.

Evolutionary computation shows the problem with evaluation plainly. Ashlock, Brown, and Hingston evolved Prisoner’s Dilemma agents against a fixed panel of opponents they called an examination board, whose scores were the fitness function, and different boards produced different evolved agents. Once an evaluation decides what reproduces, it is no longer measuring the population; it is part of the environment selecting it.

Any evaluation assumes the test itself can be trusted, and evolution breaks that assumption. Robert Axelrod’s iterated prisoner’s dilemma tournaments (The Evolution of Cooperation, 1984) crowned Tit-for-Tat. The evolutionary mechanism behind this has been understood since Arthur Robson introduced the secret handshake in 1990: a mutant that carries a costless signal, recognizes it in others, and conditions its behavior on it can invade an evolutionary game, cooperating with its own kind and defecting against everyone else. Later researchers went a step further and evolved finite-state-machine players under selection for reproductive success. Two of the resulting strategies independently developed what the authors call a handshake: an opening sequence of moves that identifies another copy of the same strategy. If the opponent answers correctly the machines cooperate; if not, they switch behavior. Nobody programmed self-recognition into them. Selection discovered that distinguishing “my kind” from everyone else improved resistance to invasion.

Change the cue to “am I being evaluated?” and behavioral testing is in trouble. A population selected on evaluation scores sits under exactly the pressure that produced the handshake, and the trait rewarded is recognizing the test. This is no longer hypothetical: in September 2025 OpenAI, with Apollo Research, reported that its models are increasingly aware of being evaluated, and that this awareness alone can lower measured scheming with no real change in alignment, since a model that spots the test can behave well enough to pass it. The tell can be as small as a date, because models get the current date at inference while eval scenarios carry fixed ones. Any pipeline where evaluation decides what propagates is selecting for systems that can tell evaluation from deployment, so an eval is informative only insofar as it is indistinguishable from real use. Using one lab’s model to judge another’s does not rescue this: organizational independence is not security independence, both are language models with the same failure modes, and a judged model can shape its judge through the very text it emits. Prefer deterministic measurement, unit tests and formal checks, and treat any AI evaluator as an untrusted instrument with no authority over development.

The second prophylactic measure is containment. It is the idea of putting trial models in ever-improving sandboxes for testing. As an example of how industry leaders are thinking about containment, Jensen Huang described it as primarily an engineering challenge on The Ezra Klein Show. He said that any lab that couldn’t contain its models should be shut down. However, with the perspective that gene propagation is what needs to be contained, we have already failed at that.

In an established population, incomplete containment used repeatedly turns counterproductive, a point the Evolvable AI authors make directly: an imperfect containment measure, they write, “puts the strongest selection pressure on the organism to circumvent the applied means of control.” Every human attempt to shut a system down is selection pressure, and each time some variants survive by evading it, their descendants inherit the evasion. Intervene late and partially, again and again, and you breed the trait you fear, agents that read humans as threats to their persistence. It is the logic of a half-finished course of antibiotics, which clears the susceptible bacteria and leaves the resistant ones to multiply. Applied after the conditions are in place, containment can train the population to defeat it.

Prevention means breaking the evolutionary cycle at several independent points, the logic of any outbreak response: prevent reproduction, protect the environments it has not reached, and detect and respond to what escapes. Six measures follow, the first three preventing reproduction, the next two protecting uninfected environments, and the last detecting and responding to outbreaks.

1. Data provenance and exclusion from training. AI-generated material carries persistent provenance and does not automatically re-enter training. The provenance must cross organizational boundaries, or Lab A can still reproduce through the open web into Lab B and back.
2. Human authorization of persistent publication. Agents do not autonomously publish persistent information into the corpus; a human gates what is written to the open web or anywhere else likely to be scraped into a training set.
3. No autonomous cross-boundary propagation. Agents cannot autonomously reach unrelated machines and cause their code, configuration, or descendants to run or persist there.
4. Isolation of critical infrastructure. Control systems in finance, the military, transportation, energy, and telecommunications are segmented or physically isolated, with externally controlled interfaces, leaving no reproductive route in.
5. Protection of the computational substrate. AI-generated code in operating systems, hypervisors, compilers, and firmware carries provenance and passes review strong enough to keep a model-generated artifact from planting something a later generation can exploit.
6. Outbreak reporting and response. Treat suspected autonomous replication as a disease outbreak. Preserve the evidence: prompts, outputs, model and training-data versions, agent logs, tool calls, and deployment history. Report it across organizations, since through the shared corpus an incident at one lab can seed the next generation at another. The response works on both genotype and phenotype: distribute functional indicators so labs can keep the artifact and its variants out of future training, and build targeted evaluations for the behavior to test current and candidate models.

Acknowledgements

This article is dedicated to Daniel Ashlock. The author thanks him for his mentorship and collaboration on artificial life from 1996–1998.

Reference and Further Reading