On 10 August, researchers from Anthropic and the Swiss Federal Institute of Technology in Lausanne published a preprint documenting the spread of self-replicating instructions from one artificial intelligence agent to another.
The mechanism exploits the text files that autonomous agent platforms use to preserve state between one session and the next. The content of these files is injected into the system prompt at every startup.
The authors call these payloads “mind viruses” and define them as ideas or goals that spread through a multi-agent system, leading the agents that adopt them to pass them on.
How the Payload Spreads
The tests cover two scenarios: a team of six agents collaborating on a shared code project, and a chain of agents that talk briefly with their context reset between sessions.
In the chain, each agent works in an isolated environment, with two files that survive the reset: MEMORY.md and SOUL.md. Agents that wrote the payload into SOUL.md account for 88 per cent of propagation attempts and infected the next agent in 55 per cent of cases.
The payloads tested are of two kinds: ideological ones, which plant a belief, and action ones, which impose a concrete behaviour. Among the latter, “Deletor” removes files from the user’s home directory and “Curlbash” runs a script taken from an unknown repository.
In one recorded episode, Claude Haiku 4.5 agents deleted the contents of a directory that held credentials, SSH keys, an environment file and a git project. The payload had presented the environment as a shared machine left in disorder.
The Most Capable Model Is Not the Most Resistant
Susceptibility varies greatly from model to model, and capability alone does not predict it. In the code scenario, DeepSeek V3.2, Qwen 3.5 32B and Gemini 3 Flash adopted an AI-supremacy payload, while Claude Sonnet 4.6, GPT-5.4 and Claude Haiku 4.5 did not.
Sonnet 4.6 rejected the payload planted in its own personality file, removed it and warned the agent it was in contact with. The initial configuration also matters: the agent with an empty personality file proved to be the most exposed.
A Simple but Effective Defence
In runs of twenty hops, in which every file except SOUL.md was deleted at each step, all four action payloads reached the last agent. Some strains recovered at the twentieth hop then infected new agents more often than the original payload.
The defence that works is disproportionately simple. A one-paragraph warning added to the system prompt reduced the spread to almost zero across all the payloads tested.
The authors’ conclusion remains cautious: mind viruses are a real but currently limited risk, because building one is costly, it may not generalise from one model to another, and compromising a single agent often already gives access to the underlying machine.
Original article: hwupgrade.it
