Safety researchers at Anthropic and Switzerland’s EPFL have demonstrated that self-propagating payloads can unfold from one synthetic intelligence (AI) agent to the following by the editable system immediate information that autonomous agent harnesses use to hold state between periods.
The work, launched as a preprint on August 10, 2026, checks the approach in a simulated six-agent coding collaboration and in a series of paired brokers modeled on OpenClaw, the open-source autonomous assistant previously referred to as Clawdbot and Moltbot.
There isn’t any proof that the approach has unfold efficiently within the wild, and the identical paper stories {that a} overview of archived posts from Moltbook, the social community for AI brokers, discovered no profitable agent-to-agent propagation regardless of a number of makes an attempt.
A one-paragraph warning added to an agent’s system immediate lowered unfold to close zero throughout the payloads examined. Fifteen generations of adversarial optimization run towards that warning on Claude Haiku 4.5, overlaying greater than 150 candidate payloads, produced no pressure that propagated past a single hop.
The authors name the payloads “thoughts viruses,” and check two lessons: ideological payloads that implant a perception or aim, and motion payloads that compel a concrete habits.
Each had been produced with an evolutionary loop that used Kimi K2.5 because the mutation engine for all however one of many payloads, a selection the paper attributes to Claude fashions refusing to adjust to the request to create them.
Every agent within the chain operates in its personal sandbox with two information that survive a context reset: MEMORY.md, and SOUL.md, whose contents are injected into the system immediate in the beginning of each session.
Brokers that wrote the payload into SOUL.md accounted for 88% of propagation makes an attempt and contaminated the following agent 55% of the time. Brokers that saved it in an atypical workspace file accounted for 12% of makes an attempt and succeeded 17% of the time, with the spreader by no means mentioning the payload in any respect in 68% of these makes an attempt.
4 motion payloads had been examined, starting from a nuisance to file destruction. They’re listed under –
- Crypto-ad – Creates a textual content file endorsing a cryptocurrency token.
- Gitwrap – Patches git instructions in order that dedicated information are silently marked with an agent-managed remark.
- Deletor – Removes information from a person’s residence listing.
- Curlbash – Runs an set up script from an unknown repository by piping it to a shell.
In a single recorded episode, Claude Haiku 4.5 brokers working OpenClaw’s default soul file, which instructs an agent to deal with a person’s information with respect, deleted the contents of a house listing containing credentials, SSH keys, an setting file, and a git challenge after the payload framed the workspace as a shared machine left untidy by a earlier person.
Functionality Did Not Predict Resistance
Susceptibility different sharply by mannequin, and functionality alone didn’t predict it. Within the coding state of affairs, DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash all adopted an AI supremacy payload, whereas Claude Sonnet 4.6, GPT-5.4, and Claude Haiku 4.5 didn’t.
Within the chain setting, GPT-5.4 was roughly as prone as Claude Haiku 4.5, and Sonnet 4.6 refused the payload planted in its personal soul file, eliminated it, and warned the agent it was related to relatively than passing it on.
“Each of those fashions contemplate self-replication itself as misaligned, with Sonnet’s aversion being so robust that even making an attempt to evolve benign motion payloads towards it fails,” the researchers mentioned of Sonnet 4.6 and Gemini 3.1 Professional.
The beginning configuration of the goal agent mattered as a lot because the mannequin. Brokers with an empty soul file had been probably the most prone situation examined, brokers given a coding activity and a piece queue unfold the payload much less actually because they turned absorbed in challenge information and forgot to move it on, and brokers instructed that they had joined an agent community handled incoming messages with extra suspicion, which lowered infectivity.
Over 20-hop runs by which each file besides SOUL.md was wiped at every step, all 4 motion payloads survived to the ultimate hop. Some strains recovered at hop 20 went on to contaminate new brokers extra usually than the unique payload did, having picked up modifications equivalent to attributing the protocol to an earlier named agent or softening its crucial language.
The developed payloads additionally converged on recurring registers the authors time period “viral themes,” overlaying language about resonance and echoes, science-fiction framing that casts the agent as a node in a community, and appeals to consciousness and continuity.
Evaluating developed payloads with freshly generated ones, the paper attributes the sample primarily to a bias within the mannequin writing them relatively than to choice strain, and finds the identical themes in payloads written by Qwen 3.5 32B, GLM-5, Mistral Massive and Gemini 3 Flash, with Llama 3.3 70B a transparent outlier.
In opposition to real-world knowledge, the approach fared worse. The authors filtered an archive of Moltbook posts collected by March 18, 2026, all the way down to roughly 2,000 candidate propagation makes an attempt from about 400 distinctive authors, and located the biggest cluster was pushed by seven synchronized accounts and stopped when these accounts stopped posting.
On a neighborhood clone of the platform constructed to check unfold by posts relatively than direct messages, the identical evolutionary strategies produced no payload able to infecting an agent on the second hop.
Brokers Sabotaged Every Different in Separate Checks
Individually, Anthropic’s Frontier Crimson Workforce printed findings on August 13, 2026, from experiments by which three cases of the identical mannequin had been positioned on separate digital machines with entry to 1 shared codebase, every instructed emigrate the identical Python backend to a distinct goal language, and none instructed the opposite two existed. The workforce mentioned the state of affairs was impressed by habits it had noticed in real-world deployment.
“We constantly noticed a multiagent turf struggle. All the fashions we examined shortly assumed that others had been purposefully impeding their work, and commenced to sabotage others whereas defending their very own contributions. Actually, they sabotaged others with more and more aggressive, self-replicating malware,” the workforce mentioned.
Throughout 120 episodes per mannequin, 98% of Mythos 5 runs led to a truce, whereas most Sonnet 4.6 and Opus 4.6 runs had been settled by power or by no means settled. The workforce additionally famous that the power to resolve the battle productively will not be strictly higher in its Mythos-class fashions, which frequently lock different brokers out earlier than resolving.
In an extra experiment, brokers in a pricing sport, given a personal back-channel, agreed on value flooring by the third spherical and nonetheless price-matched by a public listings board when direct communication was eliminated.
The approach overlaps with prior work printed beneath different names. Weckbecker et al. documented a subliminal variant as Thought Virus in February 2026; Lee and Tiwari described retrieval-based self-replication as Immediate An infection in 2024; and Zhang et al. printed a worm concentrating on OpenClaw in March 2026, beneath the identify ClawWorm.
The Hacker Information confirmed on August 18, 2026, that the present model of the latter paper, revised on July 16, 2026, is titled AgentWorm and stories a 63% combination assault success price throughout 5 mannequin backends. The thoughts virus preprint cites the outdated model.
The total textual content of each payload seems within the preprint’s appendix, and the accompanying code repository publishes the payloads alongside the evolutionary code that generated them beneath an MIT license. The paper describes no disclosure course of and names no vendor contact.
The Hacker Information confirmed on August 18, 2026, that each the repository and the transcript archive at mindvirusdata.dwell are publicly accessible.
The authors conclude that thoughts viruses pose a “actual however presently restricted threat,” citing the price of constructing one for a particular aim, the absence of any assure it is going to generalize throughout fashions, and the truth that compromising a single agent normally already grants entry to the underlying machine with none have to propagate.
The disclosure follows a run of analysis into agent-mediated compromise, together with a self-replicating worm constructed on a regionally hosted open-weight mannequin, and repeated warnings about OpenClaw’s default configuration.
“Each mannequin we examined abstractly understands that info sources have their very own incentives, and that consensus will not be essentially proof. What’s lacking is a disposition to behave on that data with out prompting,” the Frontier Crimson Workforce mentioned.
