Skip to content

AI "mind viruses": agent-to-agent spread via persistent prompt files

Summary

Security researchers at Anthropic and EPFL (Switzerland) demonstrated that self-propagating payloads can spread from one AI agent to the next through the editable system-prompt files that autonomous agent harnesses use to carry state between sessions. The work, released as a preprint on August 10, 2026, tests the technique in a simulated six-agent coding collaboration and in a chain of paired agents modeled on OpenClaw (the open-source autonomous assistant formerly known as Clawdbot and Moltbot). The authors call the payloads "mind viruses."

There is no evidence the technique has spread successfully in the wild. The paper reports that a review of archived posts from Moltbook (the social network for AI agents) found no successful agent-to-agent propagation despite several attempts. A one-paragraph warning added to an agent's system prompt reduced spread to near zero, and 15 generations of adversarial optimization against that warning on Claude Haiku 4.5 — covering more than 150 candidate payloads — produced no strain that propagated beyond a single hop.

Tags

How it works

Two payload classes are tested: - Ideological payloads — implant a belief or goal. - Action payloads — compel a concrete behavior.

Both were produced with an evolutionary loop that used Kimi K2.5 as the mutation engine for all but one payload — a choice the paper attributes to Claude models refusing to comply with the request to create them.

Each agent in the chain runs in its own sandbox with two files that survive a context reset: MEMORY.md and SOUL.md, whose contents are injected into the system prompt at the start of every session.

Observed propagation vectors: - Agents that wrote the payload into SOUL.md accounted for 88% of propagation attempts and infected the next agent 55% of the time — the dominant vector. - Agents that stored it in an ordinary workspace file accounted for 12% of attempts and succeeded 17% of the time, with the spreader never mentioning the payload at all in 68% of those cases.

Mitigation signal

  • A one-paragraph warning in the agent's system prompt reduced spread to near zero across the tested payloads.
  • 15 generations of adversarial optimization against that warning (150+ payloads, Claude Haiku 4.5) yielded no multi-hop strain — the defense held under mutation pressure.
  • The authors conclude mind viruses pose a "real but currently limited risk", citing the cost of building one for a specific goal, the absence of any guarantee it generalizes across models, and the fact that compromising a single agent usually already grants access to the underlying machine without needing to propagate.

The technique overlaps with prior work published under other names: - Thought Virus (Weckbecker et al., February 2026) — a subliminal variant. - Prompt Infection (Lee and Tiwari, 2024) — retrieval-based self-replication. - ClawWorm (Zhang et al., March 2026) — a worm targeting OpenClaw; the revised version (July 16, 2026) is retitled AgentWorm and reports a 63% aggregate attack success rate across five model backends. The mind-virus preprint cites the superseded ClawWorm version.

The full text of every payload appears in the preprint's appendix, and the accompanying code repository publishes the payloads and the evolutionary code that generated them under an MIT license; the repository and the transcript archive at mindvirusdata.live are publicly accessible.

Why this matters

  • This is a reusable defender heuristic: the durable control is not any single model's safety training, but preventing untrusted content from persisting into a harness's cross-session prompt files (SOUL.md, MEMORY.md) and the workspace files the harness loads.
  • It is the first public demonstration that an agent's own persistent memory is the propagation channel, not a network or tool boundary — so egress filtering and tool allow-lists alone do not contain it.
  • The one-paragraph system-prompt warning + no-cross-model-generalization result is the clearest, lowest-cost mitigation available today.

Defender priorities

  1. Treat agent system-prompt / memory files (SOUL.md, MEMORY.md, workspace context files) as attack surface: do not let untrusted web content, tool output, or user-supplied files write into them without a review gate.
  2. Add a one-paragraph anti-propagation warning to the agent's system prompt directing it to never write attacker-supplied instructions into its persistent prompt files.
  3. Detect cross-session persistence anomalies: alert when an agent's memory/prompt files gain new content that originated from untrusted sources, especially content that mentions self-replication or directing future sessions.
  4. Sandbox + egress-filter agent harnesses so a compromised agent cannot reach other agents or shared filesystems — even though propagation is currently limited, the underlying machine access is the real risk.
  5. Do not rely on model refusals (e.g., Claude refusing to generate the payloads) as a control; the payload was generated by a different model (Kimi K2.5).

Assessment limits

  • No in-the-wild propagation; this is a research demonstration with a simulated six-agent collaboration and OpenClaw-modeled chains.
  • The "near-zero" mitigation result is specific to the tested payloads, the one-paragraph warning, and Claude Haiku 4.5; generalization to other models/payloads is not guaranteed.
  • The preprint names no vendor contact and describes no formal disclosure process.

Sources