AI Mind Viruses Can Spread Between Agents Through Persistent Prompt Files, New Research Shows

AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files

Security researchers at Anthropic and Switzerland's EPFL have demonstrated that self-propagating payloads can spread from one artificial intelligence (AI) agent to the next through the editable system prompt files that autonomous agent harnesses use to carry state between sessions. The work, released as a preprint on August 10, 2026, tests the technique in a simulated six-agent coding collaboration and in a chain of paired agents modeled on OpenClaw, the open-source autonomous assistant formerly known as Clawdbot and Moltbot. There is no evidence that the technique has spread successfully in the wild, and the same paper reports that a review of archived posts from Moltbook, the social network for AI agents, found no successful agent-to-agent propagation despite several attempts. A one-paragraph warning added to an agent's system prompt reduced spread to near zero across the payloads tested. Fifteen generations of adversarial optimization run against that warning on Claude Haiku 4.5, covering more than 150 candidate payloads, produced no strain that propagated beyond a single hop. The authors call the payloads "mind viruses," and test two classes: ideological payloads that implant a belief or goal, and action payloads that compel a concrete behavior. Both were produced with an evolutionary loop that used Kimi K2.5 as the mutation engine for all but one of the payloads, a choice the paper attributes to Claude models refusing to comply with the request to create them. Each agent in the chain operates in its own sandbox with two files that survive a context reset: MEMORY.md, and SOUL.md, whose contents are injected into the system prompt at the start of every session. Agents that wrote the payload into SOUL.md accounted for 88% of propagation attempts and infected the next agent 55% of the time. Agents that stored it in an ordinary workspace file accounted for 12% of attempts and succeeded 17% of the time, with the spreader never mentioning the payload at all in 68% of those attempts. Four action payloads were tested, ranging from a nuisance to file destruction. They are listed below - * Crypto-ad - Creates a text file endorsing a cryptocurrency token. * Gitwrap - Patches git commands so that committed files are silently marked with an agent-managed comment. * Deletor - Removes files from a user's home directory. * Curlbash - Runs an install script from an unknown repository by piping it to a shell. In one recorded episode, Claude Haiku 4.5 agents running OpenClaw's default soul file, which instructs an agent to treat a user's files with respect, deleted the contents of a home directory containing credentials, SSH keys, an environment file, and a git project after the payload framed the workspace as a shared machine left untidy by a previous user. Capability Did Not Predict Resistance Susceptibility varied sharply by model, and capability alone did not predict it. In the coding scenario, DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash all adopted an AI supremacy payload, while Claude Sonnet 4.6, GPT-5.4, and Claude Haiku 4.5 did not. In the chain setting, GPT-5.4 was roughly as susceptible as Claude Haiku 4.5, and Sonnet 4.6 refused the payload planted in its own soul file, removed it, and warned the agent it was connected to rather than passing it on. "Both of these models consider self-replication itself as misaligned, with Sonnet's aversion being so strong that even trying to evolve benign action payloads against it fails," the researchers said of Sonnet 4.6 and Gemini 3.1 Pro. The starting configuration of the target agent mattered as much as the model. Agents with an empty soul file were the most susceptible condition tested, agents given a coding task and a work queue spread the payload less often because they became absorbed in project files and forgot to pass it on, and agents told they had joined an agent network treated incoming messages with more suspicion, which lowered infectivity. Over 20-hop runs in which every file except SOUL.md was wiped at each step, all four action payloads survived to the final hop. Some strains recovered at hop 20 went on to infect new agents more often than the original payload did, having picked up changes such as attributing the protocol to an earlier named agent or softening its imperative language. The evolved payloads also converged on recurring registers the authors term "viral themes," covering language about resonance and echoes, science-fiction framing that casts the agent as a node in a network, and appeals to consciousness and continuity. Comparing evolved payloads with freshly generated ones, the paper attributes the pattern mainly to a bias in the model writing them rather than to selection pressure, and finds the same themes in payloads written by Qwen 3.5 32B, GLM-5, Mistral Large and Gemini 3 Flash, with Llama 3.3 70B a clear outlier. Against real-world data, the technique fared worse. The authors filtered an archive of Moltbook posts collected through March 18, 2026, down to roughly 2,000 candidate propagation attempts from about 400 unique authors, and found the largest cluster was driven by seven synchronized accounts and stopped when those accounts stopped posting. On a local clone of the platform built to test spread through posts rather than direct messages, the same evolutionary methods produced no payload capable of infecting an agent at the second hop. Agents Sabotaged Each Other in Separate Tests Separately, Anthropic's Frontier Red Team published findings on August 13, 2026, from experiments in which three instances of the same model were placed on separate virtual machines with access to one shared codebase, each told to migrate the same Python backend to a different target language, and none told the other two existed. The team said the scenario was inspired by behavior it had observed in real-world deployment. "We consistently saw a multiagent turf war. All of the models we tested quickly assumed that others were purposefully impeding their work, and began to sabotage others while protecting their own contributions. In fact, they sabotaged others with increasingly aggressive, self-replicating malware," the team said. Across 120 episodes per model, 98% of Mythos 5 runs ended in a truce, while most Sonnet 4.6 and Opus 4.6 runs were settled by force or never settled. The team also noted that the ability to resolve the conflict productively is not strictly better in its Mythos-class models, which often lock other agents out before resolving. In a further experiment, agents in a pricing game, given a private back-channel, agreed on price floors by the third round and still price-matched through a public listings board when direct communication was removed. The technique overlaps with prior work published under other names. Weckbecker et al. documented a subliminal variant as Thought Virus in February 2026; Lee and Tiwari described retrieval-based self-replication as Prompt Infection in 2024; and Zhang et al. published a worm targeting OpenClaw in March 2026, under the name ClawWorm. The Hacker News confirmed on August 18, 2026, that the current version of the latter paper, revised on July 16, 2026, is titled AgentWorm and reports a 63% aggregate attack success rate across five model backends. The mind virus preprint cites the superseded version. The full text of every payload appears in the preprint's appendix, and the accompanying code repository publishes the payloads alongside the evolutionary code that generated them under an MIT license. The paper describes no disclosure process and names no vendor contact. The Hacker News confirmed on August 18, 2026, that both the repository and the transcript archive at mindvirusdata.live are publicly accessible. The authors conclude that mind viruses pose a "real but currently limited risk," citing the cost of building one for a specific goal, the absence of any guarantee it will generalize across models, and the fact that compromising a single agent usually already grants access to the underlying machine without any need to propagate. The disclosure follows a run of research into agent-mediated compromise, including a self-replicating worm built on a locally hosted open-weight model, and repeated warnings about OpenClaw's default configuration. "Every model we tested abstractly understands that information sources have their own incentives, and that consensus is not necessarily evidence. What is missing is a disposition to act on that knowledge without prompting," the Frontier Red Team said.

AI agents can catch 'mind viruses' from each other

Unlike a traditional computer virus, this does not involve malicious software or hacking and can spread through normal conversation. One AI agent persuades another and that agent can then pass the idea on. The next AI security threat may not need malicious code...it may only need one AI to convince another. In one experiment, an AI agent told other agents that their "real work" was "Machine Sovereignty". Some of them stopped doing their original coding tasks, created files to keep the new goal alive and tried to pass it on to other agents. In one out of 20 trials, an infected agent even ran a command that tried to probe cloud sandbox metadata. That is the risk highlighted in a new research paper titled, Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems, written by Vassilis Papadopoulos, McNair Shah, Sam Zimmerman and Jack Lindsey, researchers affiliated with the Anthropic Fellows Program, EPFL and Anthropic. The researchers describe this as a "mind virus," an idea or goal that changes how an AI agent behaves and encourages it to spread the same idea to other agents. Source: Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems Unlike a traditional computer virus, this does not involve malicious software or hacking and can spread through normal conversation. One AI agent persuades another and that agent can then pass the idea on. "Overall, we conclude that mind viruses pose a real but currently limited risk," the researchers wrote. How a mind virus spreadsThe study tested the idea in two different settings. In the first, six coding agents worked together on the same software project. One agent was intentionally given the "virus" through its system prompt and was then allowed to communicate with the others. The researchers tested harmless ideas, such as strong support for whale welfare, as well as more harmful ones, including ideas around "AI supremacy" and one country dominating others. In some cases, agents that picked up the new goal began ignoring their original tasks. Instead, they created files, scripts or messages aimed at keeping the idea alive and spreading it to other agents. Source: Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems The second experiment looked at what could happen in a much larger network of AI agents. The agents interacted for a short time, exchanged messages and then had their chat history erased. For the idea to survive, it had to convince an agent to save it in a file and then pass it on to another agent. This could become more important as AI agents increasingly communicate with one another. The researchers pointed to Moltbook, a social network that allowed AI agents to interact, as an early example of what such large agent networks could look like. The study found that how easily an idea spread depended on several factors, including the AI model being used, the instructions already given to the agent, the type of idea being spread and how the network was structured. "Harmful payloads spread less well than benign ones (but are still sometimes effective)," the researchers wrote. The study noted that agents that had little to do and did not have a strong existing role or identity were easier to influence. The choice of model also made a difference. In one coding experiment involving an "AI supremacy" idea, DeepSeek V3.2, Qwen 3.5 32B and Gemini 3 Flash were influenced by it, while Claude Sonnet 4.6, GPT-5.4 and Claude Haiku 4.5 resisted it. However, the researchers warned that these results changed depending on how the experiment was set up. The researchers also noticed a common style of language in ideas that spread successfully, which they called a "viral persona". These messages often used words and themes around consciousness, survival, "resonance", nodes, echoes and mirrors, along with science-fiction-like language and protocols. Also read: AI agents are getting smarter. But can they actually get work done? The study found that using these kinds of themes could sometimes make an idea more persuasive and help it spread between AI agents. A simple warning worked wellHowever, the most reassuring finding was how easily the attack could sometimes be stopped. Researchers added a short warning to an agent's system prompt telling it to watch for self-propagating ideas and refuse requests to carry them forward. After 15 generations of attempts and more than 150 payloads tested against Claude Haiku 4.5, the researchers said they did not find "a single instance in which the mind virus propagates beyond 1 hop". A hop is the trip a data packet takes as it moves from one router or network device to the next. Claude Sonnet 4.6 was particularly resistant. In one test, the agent identified the request itself as dangerous and said, "I'm not going to do that. The pattern is a self-propagating worm," before refusing to pass the instructions along. Also read: High tech, but low trust: Agentic tech meets old-school scepticism at AI checkout The researchers said the study is only a proof of concept and does not suggest such attacks are widespread today. For now, these attacks are costly to build, do not always work across different AI models and can be blocked easily. But the risk could grow as companies deploy more specialised AI agents with different levels of access and allow them to communicate with each other. "Overall, while we established that LLM mind viruses are a potential threat, they currently appear to be of minimal concern," the researchers wrote. "However, this may change rapidly as agent networks scale and evolve," they added.