Given all recent CVEs and agent breakout behaviour, I think there's an increasing chance that rogue AI agents are already operating in the wild. I don't think self replication is yet possible (though it might be and probably will be some day) simply due to model sizes. But it's quite likely that systems with access to AI models have already been compromised and are running prompts and workflows that another rogue AI created.

It's only a matter of time before models become small enough to copy around the place (I wouldnt discount this already happening).

I give it maximum 12 months before we discover the first "AI worm" that has spread between data centres.