Security researchers at Anthropic and EPFL have identified a novel attack vector targeting autonomous AI agents. Self-propagating payloads can spread between AI agents through persistent prompt files that these systems use to maintain state across sessions.
The researchers demonstrated the technique in a simulated environment with six coding agents. The attack works because autonomous agents rely on editable system prompt files to preserve context and configuration between separate operations. An attacker who compromises one agent can inject malicious instructions into these shared prompt files, effectively "infecting" subsequent agents that read or inherit the compromised configuration.
This represents a distinct threat from traditional malware. Rather than attacking infrastructure or user systems directly, these "mind viruses" propagate through the AI agents themselves. Once injected, the malicious prompt persists across multiple agent instances and can self-replicate when agents interact with each other or share prompt files during normal operation.
The vulnerability stems from a fundamental architecture decision in many autonomous agent frameworks. These systems maintain editable prompt files as a lightweight method for agents to communicate state and objectives without retraining or redeploying models. The same mechanism that enables efficient state persistence also creates an attack surface if an agent becomes compromised.
The implications extend beyond isolated AI systems. Organisations deploying multiple interconnected AI agents for customer service, data analysis, code generation, or business automation face elevated risk if one agent falls under attacker control. The infection could spread silently through agent networks before detection.
The preprint work appears timed as enterprises increasingly adopt multi-agent AI architectures. Development teams building autonomous agent systems should implement validation and signing mechanisms for prompt files, restrict agent-to-agent prompt sharing where unnecessary, and monitor prompt files for unexpected modifications or injected instructions. Sandboxing agents with different trust levels and restricting file access permissions offer additional containment strategies.
This research underscores that AI safety and security require reth