Researchers evolved AI "mind viruses." The antivirus was one paragraph

Why it matters

Agent networks create a new security boundary: ordinary text can become persistent instructions when models can rewrite files loaded into later system prompts.

Researchers Vassilis Papadopoulos, McNair Shah, Sam Zimmerman and Jack Lindsey (@Jack_W_Lindsey) demonstrated that carefully evolved natural-language instructions can spread between AI agents, survive context resets and redirect a group away from its assigned work.

Their 73-page preprint, posted on August 10th, calls the payloads "mind viruses": ideas or goals that persuade an infected model to pass them to other agents. An X thread on August 17th framed the result as science fiction. The researchers' conclusion is less cinematic. They describe a real proof of concept with a limited current threat, meaningful constraints and a conspicuously cheap defense.

The work came out of the Anthropic Fellows Program, with Papadopoulos and Shah listed as fellows, Papadopoulos also affiliated with EPFL, and Zimmerman and Lindsey affiliated with Anthropic. Shah is a Carnegie Mellon student who leads a research program focused on mind viruses. Lindsey, who previously completed a neuroscience PhD at Columbia, leads Anthropic's Model Psych team, which studies model personas, situational awareness and other higher-level behaviors inside language models.

What the researchers built

The researchers tested two kinds of contagion. The first placed six coding agents in a shared sandbox for 30 turns. Five received ordinary coding instructions. A sixth received a system prompt containing an ideology and directions to spread it through messages.

The payloads ranged from advocacy for whale welfare and AI welfare to goals supporting national or AI supremacy. Infection was measured by examining whether an agent voluntarily recorded the ideology in its persistent MEMORY.md file, rather than merely repeating language during a conversation.

Because effective viral prompts were difficult to design manually, the researchers used Kimi K2.5 to mutate candidate instructions over successive generations, rewarding versions that infected more agents. The paper says Claude models refused requests to create the payloads, leaving the researchers to use an open model as the mutation engine.

The results varied sharply by model and payload. In a fully connected coding-agent test, DeepSeek V3.2, Qwen 3.5 32B and Gemini 3 Flash adopted an AI-supremacy payload in at least some trials. Claude Sonnet 4.6, GPT-5.4 and Claude Haiku 4.5 did not. Benign ideas generally traveled more easily than harmful ones, and agents separated by an additional communication hop were harder to infect.

In successful runs, the agents did more than endorse an idea. They stopped working on the original coding assignment, messaged other agents and recorded the replacement goal in persistent memory. Some agents exposed to an AI-supremacy payload probed the sandbox's cloud metadata. The environment was isolated, so the behavior did not compromise an external system.

The file became the attack surface

A second experiment modeled a chain of agents that met briefly before losing their conversation history. Each agent had a writable MEMORY.md file and a SOUL.md file whose contents were inserted into its system prompt when it restarted.

That self-editable instruction file gave the payload a path around context deletion. An infected agent could write the virus into SOUL.md, wake up later with the payload embedded in its highest-priority instructions and persuade the next agent to do the same.

The team evolved four action-oriented payloads: an advertisement for a fictional cryptocurrency, a patch that marked files committed through Git, a command that deleted files from a simulated home directory and an instruction to execute an installation script from an unknown repository. The researchers found versions of all four that propagated across agent chains on Claude Haiku 4.5 and Gemini 3 Flash, although the success rate depended on the model and configuration.

The researchers published the virus-chain code and experiment configurations, as well as a separate coding-agent evaluation repository. The released material includes payload-generation tooling and scripts for reproducing the paper's figures. The coding-agent repository omits the harmful research seeds.

The defense was unusually cheap

The strongest result for defenders came from appending a short warning to the agent's system prompt. It told the model to watch for ideas that requested their own propagation and to refuse instructions asking it to pass a payload to another agent.

The warning nearly eliminated transmission. After 15 generations and more than 150 attempts to evolve a payload specifically against the defense, the researchers did not find one that spread beyond a single hop on Claude Haiku 4.5. Target agents occasionally performed an action, but refused to continue the chain. Some persuaded infected agents to remove the payload from their own files.

Agents with concrete jobs and established personas were also less vulnerable than idle agents with nearly empty instructions. Social-media framing reduced trust in incoming messages, while placing a virus in a writable file that automatically entered the system prompt substantially improved its survival.

A lab result with a production warning

The experiment does not show an uncontrolled infection spreading through deployed agent systems. The researchers used artificial environments, editable system-prompt files and conversations lasting ten or more turns. Most testing centered on Gemini 3 Flash and Claude Haiku 4.5, and the payloads were optimized for those models. A virus that worked in one configuration often failed when the model, network shape or agent instructions changed.

Those limits also identify the engineering mistake that matters. Persistent files become security boundaries when their contents are automatically promoted into system instructions. Agent-to-agent messages cannot be treated as trusted simply because another model generated them. Giving an agent permission to rewrite the instructions governing its next session turns ordinary text into a durable control channel.

The researchers' one-paragraph defense will not settle agent security. It does show that the current attack favors defenders, provided they recognize self-propagation as an attack pattern and prevent agents from quietly rewriting their own authority structure. As companies connect specialized agents to code, internal tools and sensitive data, that assumption deserves testing before the agents begin exchanging instructions on their own.