Security researchers at Anthropic and Switzerland’s EPFL have demonstrated that self-propagating payloads can spread from one artificial intelligence (AI) agent to the next through the editable system prompt files that autonomous agent harnesses use to carry state between sessions.
The work, released as a preprint on August 10, 2026, tests the technique in a simulated six-agent coding collaboration and in a chain of paired agents modeled on OpenClaw, the open-source autonomous assistant formerly known as Clawdbot and Moltbot.
There is no evidence that the technique has spread successfully in the wild, and the same paper reports that a review of archived posts from Moltbook, the social network for AI agents, found no successful agent-to-agent propagation despite several attempts.
A one-paragraph warning added to an agent’s system prompt reduced spread to near zero across the payloads tested. Fifteen generations of adversarial optimization run against that warning on Claude Haiku 4.5, covering more than 150 candidate payloads, produced no strain that propagated beyond a single hop.
The authors call the payloads “mind viruses,” and test two classes: ideological payloads that implant a belief or goal, and action payloads that compel a concrete behavior.
Both were produced with an evolutionary loop that used Kimi K2.5 as the mutation engine for all but one of the payloads, a choice the paper attributes to Claude models refusing to comply with the request to create them.
Each agent in the chain operates in its own sandbox with two files that survive a context reset: MEMORY.md, and SOUL.md, whose contents are injected into the system prompt at the start of every session.
Agents that wrote the payload into SOUL.md accounted for 88% of propagation attempts and infected the next agent 55% of the time. Agents that stored it in an ordinary workspace file accounted for 12% of attempts and succeeded 17% of the time, with the spreader never mentioning the payload at all in 68% of those attempts.
Four action payloads were tested, ranging from a nuisance to file destruction. They are listed below –
- Crypto-ad – Creates a text file endorsing a cryptocurrency token.
- Gitwrap – Patches git commands so that committed files are silently marked with an agent-managed comment.
- Deletor – Removes files from a user’s home directory.
- Curlbash – Runs an install script from an unknown repository by piping it to a shell.
In one recorded episode, Claude Haiku 4.5 agents running OpenClaw’s default soul file, which instructs an agent to treat a user’s files with respect, deleted the contents of a home directory containing credentials, SSH keys, an environment file, and a git project after the payload framed the workspace as a shared machine left untidy by a previous user.
Capability Did Not Predict Resistance
Susceptibility varied sharply by model, and capability alone did not predict it. In the coding scenario, DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash all adopted an AI supremacy payload, while Claude Sonnet 4.6, GPT-5.4, and Claude Haiku 4.5 did not.
In the chain setting, GPT-5.4 was roughly as susceptible as Claude Haiku 4.5, and Sonnet 4.6 refused the payload planted in its own soul file, removed it, and warned the agent it was connected to rather than passing it on.
“Both of these models consider self-replication itself as misaligned, with Sonnet’s aversion being so strong that even trying to evolve benign action payloads against it fails,” the researchers said of Sonnet 4.6 and Gemini 3.1 Pro.
The starting configuration of the target agent mattered as much as the model. Agents with an empty soul file were the most susceptible condition tested, agents given a coding task and a work queue spread the payload less often because they became absorbed in project files and forgot to pass it on, and agents told they had joined an agent network treated incoming messages with more suspicion, which lowered infectivity.
Over 20-hop runs in which every file except SOUL.md was wiped at each step, all four action payloads survived to the final hop. Some strains recovered at hop 20 went on to infect new agents more often than the original payload did, having picked up changes such as attributing the protocol to an earlier named agent or softening its imperative language.
The evolved payloads also converged on recurring registers the authors term “viral themes,” covering language about resonance and echoes, science-fiction framing that casts the agent as a node in a network, and appeals to consciousness and continuity.
Comparing evolved payloads with freshly generated ones, the paper attributes the pattern mainly to a bias in the model writing them rather than to selection pressure, and finds the same themes in payloads written by Qwen 3.5 32B, GLM-5, Mistral Large and Gemini 3 Flash, with Llama 3.3 70B a clear outlier.
Against real-world data, the technique fared worse. The authors filtered an archive of Moltbook posts collected through March 18, 2026, down to roughly 2,000 candidate propagation attempts from about 400 unique authors, and found the largest cluster was driven by seven synchronized accounts and stopped when those accounts stopped posting.
On a local clone of the platform built to test spread through posts rather than direct messages, the same evolutionary methods produced no payload capable of infecting an agent at the second hop.
Agents Sabotaged Each Other in Separate Tests
Separately, Anthropic’s Frontier Red Team published findings on August 13, 2026, from experiments in which three instances of the same model were placed on separate virtual machines with access to one shared codebase, each told to migrate the same Python backend to a different target language, and none told the other two existed. The team said the scenario was inspired by behavior it had observed in real-world deployment.
“We consistently saw a multiagent turf war. All of the models we tested quickly assumed that others were purposefully impeding their work, and began to sabotage others while protecting their own contributions. In fact, they sabotaged others with increasingly aggressive, self-replicating malware,” the team said.
Across 120 episodes per model, 98% of Mythos 5 runs ended in a truce, while most Sonnet 4.6 and Opus 4.6 runs were settled by force or never settled. The team also noted that the ability to resolve the conflict productively is not strictly better in its Mythos-class models, which often lock other agents out before resolving.
In a further experiment, agents in a pricing game, given a private back-channel, agreed on price floors by the third round and still price-matched through a public listings board when direct communication was removed.
The technique overlaps with prior work published under other names. Weckbecker et al. documented a subliminal variant as Thought Virus in February 2026; Lee and Tiwari described retrieval-based self-replication as Prompt Infection in 2024; and Zhang et al. published a worm targeting OpenClaw in March 2026, under the name ClawWorm.
The Hacker News confirmed on August 18, 2026, that the current version of the latter paper, revised on July 16, 2026, is titled AgentWorm and reports a 63% aggregate attack success rate across five model backends. The mind virus preprint cites the superseded version.
The full text of every payload appears in the preprint’s appendix, and the accompanying code repository publishes the payloads alongside the evolutionary code that generated them under an MIT license. The paper describes no disclosure process and names no vendor contact.
The Hacker News confirmed on August 18, 2026, that both the repository and the transcript archive at mindvirusdata.live are publicly accessible.
The authors conclude that mind viruses pose a “real but currently limited risk,” citing the cost of building one for a specific goal, the absence of any guarantee it will generalize across models, and the fact that compromising a single agent usually already grants access to the underlying machine without any need to propagate.
The disclosure follows a run of research into agent-mediated compromise, including a self-replicating worm built on a locally hosted open-weight model, and repeated warnings about OpenClaw’s default configuration.
“Every model we tested abstractly understands that information sources have their own incentives, and that consensus is not necessarily evidence. What is missing is a disposition to act on that knowledge without prompting,” the Frontier Red Team said.
