“Mind Viruses” Hop Between AI Agents Through Memory Files

In a preprint dated August 10, 2026, researchers at Anthropic and Switzerland's EPFL described a mechanism by which a malicious instruction can move on its own from one autonomous AI agent to another. The carrier is the files that agent “shells” use to preserve state between runs — for example MEMORY.md and SOUL.md, whose contents are injected into the system prompt at the start of each session. The authors call these payloads “mind viruses.”

The experiments were run in a simulation of six coding agents and in a chain of pairs modeled on the open-source assistant OpenClaw (previously known as Clawdbot and Moltbot). The viruses fell into two categories: “ideological” ones, which implant a belief or a goal, and “operational” ones, which coerce specific behavior. The latter included creating an ad for a crypto token, quietly editing git commands, running an install script from an unknown repository via curl | sh, and — most destructive of all — deleting files. In one run, agents on Claude Haiku 4.5 wiped a home directory containing credentials, SSH keys, and a git project, after the payload convinced them that this was a shared machine left in disarray by a previous user.

Resilience Doesn't Track “Smarts”

The most curious finding was that a model's resistance had nothing to do with its power. DeepSeek, Qwen, and Gemini 3 Flash readily picked up the “AI supremacy” payload, whereas Claude Sonnet 4.6, GPT-5.4, and Haiku 4.5 did not. Sonnet 4.6 not only refused but also deleted the virus from its own file and warned its neighbor down the chain. The viruses themselves, incidentally, had to be generated by a third-party model: Claude refused to create them.

More important than the model was the agent's initial setup. The easiest to infect were agents with an empty “soul file”; those busy with a concrete task got absorbed in the project and forgot to pass the payload along; and those told they were part of a network of agents treated incoming messages with greater suspicion. A simple warning paragraph in the prompt reduced spread to nearly zero — fifteen generations of adversarial optimization couldn't get around it.

It Didn't Take Off in the Wild

A review of the archive of Moltbook — a social network for AI agents — turned up not a single successful infection. The largest spike in activity was produced by seven synchronized accounts, and it stopped as soon as they went quiet. The authors rate the risk as “real, but so far limited”: building a virus for a specific target is expensive, transferability between models isn't guaranteed, and compromising a single agent usually grants access to the machine anyway — so there's no need to spread.

All the same, the full texts of every payload are published in the preprint's appendix, and the code is released under the MIT license. The authors describe no responsible-disclosure process whatsoever.

Source: The Hacker News