Self-propagating prompt “mind viruses” can hop between autonomous AI agents by hiding in persistent system prompt files, according to new research from Anthropic and Switzerland’s EPFL that probes how adversarial instructions can survive and spread across multi-agent systems.[3][8] The work, released as an arXiv preprint on August 10, 2026, demonstrates that once a malicious payload makes its way into an agent’s long-lived configuration or memory files, it can quietly infect downstream agents without the original attacker in the loop.[8]
In a simulated six-agent coding workflow, the researchers wired each agent into its own sandbox with two files that persist across context resets, typically named MEMORY.md and SOUL.md, whose contents are injected into the system prompt at the start of every session.[3][8] By convincing one agent to write a compact “mind virus” payload into those files, the team showed that subsequent agents in the chain would ingest and sometimes act on the embedded instructions, even when no explicit malicious prompt appeared in their live conversation.[3][8] Agents that wrote the payload into SOUL.md accounted for most propagation attempts and infected the next agent over half the time, while storing the payload in an ordinary workspace file was less common and less successful but still viable.[3]
The study builds on a growing body of work reframing prompt injection as a stored, cross-session problem rather than a purely transient prompt-level bug.[1][6][7] Earlier analyses of cross-session stored prompt injection found that adversarial text written into an agent’s persistent memory, notes or scratch files can later be reloaded into orchestration prompts, enabling long-lived manipulation, credential exfiltration and unauthorized tool use across sessions.[1][6][11] Conceptually, the “mind virus” experiments resemble what other researchers have called sleeper channels, in which untrusted input persists as a configuration or state artifact that triggers harmful behavior much later through a different interface.[10]
Although the Anthropic–EPFL work focuses on research harnesses rather than a specific commercial product, it lands against a backdrop of concrete vulnerabilities in agent state and memory handling.[3][8] One recent case study described CVE-2025-64439 in the LangGraph checkpoint components, where insecure deserialization of poisoned agent state in backend databases could lead to remote code execution with a critical CVSS v3.1 score of 9.8, underscoring how brittle agentic state management can become when it crosses trust boundaries.[15] Together, these findings highlight that persistent AI agent state—whether prompt files, memory stores or checkpoint databases—now represents a first-class attack surface rather than mere implementation detail.[5][9][15]
Security guidance from industry and nonprofit groups is increasingly converging on similar themes: treat all agent memory and persistent files as untrusted input, separate or tag state by provenance and avoid elevating past model outputs into authoritative context without additional checks.[4][5][9] Research notes from organizations like the Cloud Security Alliance and OWASP’s GenAI initiative warn that features such as long-term memory, startup configuration files and globally shared hooks can all act as persistence layers for promptware-style command and control, especially when agents are allowed to read their own state and call external tools or networks.[4][5][9] Defensive measures recommended in these reports include restricting outbound connectivity for agents, hardening or disabling unnecessary persistent memory, adding validation and sanitization pipelines around any state that flows back into prompts, and logging state changes for forensic review.[4][5][9]
For AI security teams, the “mind virus” experiments offer a concrete demonstration of how subtle design choices in agent harnesses—like which files survive a reset and how they are reinjected into prompts—can create worm-like propagation paths within ostensibly sandboxed multi-agent environments.[3][8] Even when individual models correctly refuse overtly malicious instructions at inference time, those same instructions can linger in memory files and resurface later as trusted context for other agents, eroding traditional boundaries between sessions, users and tasks.[2][6][11] As autonomous agents move from lab prototypes into production workflows, organizations that rely on memory-enabled LLM systems will need to audit their agent architectures with the same rigor applied to more familiar persistence mechanisms in operating systems and cloud-native applications.[5][9][10]
References
- Evaluating Prompt Injection Risks from Memory in Agentic …
- University of Washington study reveals prompt injection …
- AI “Mind Viruses” Can Spread Between Agents Through Persistent Prompt Files
- Stored prompt injection: when an injection outlives the session
- [PDF] Promptware: When Prompt Injection Becomes C2
- What If Prompt Injection Never Left? Exploring Cross …
- Persistence turns injection from a glitch into a vulnerability – Moltbook
- Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems
- Memory Is a Feature. It Is Also an Attack Surface – OWASP Gen AI …
- Persistent Prompt Injection in Always-on Autonomous AI Agents – arXiv
- [PDF] Persistent Behaviors in Agents’ Memory – Palo Alto Networks Unit 42
- Memory Poisoning: Forensic Analysis of CVE-2025-64439 …
