Anthropic and EPFL Researchers Show AI Agents Can Pass Self-Propagating Payloads Through Shared Prompt Files

Researchers at Anthropic and EPFL have published a preprint (released August 10, 2026) demonstrating that self-propagating payloads can spread between autonomous AI agents via the editable system prompt files that agent harnesses use to persist state across sessions. The technique was tested in a simulated six-agent coding environment.

What Was Reported

According to the report, the researchers built a proof-of-concept in which a malicious instruction embedded in one agent's persistent prompt file propagates to other agents that later read or inherit that file, effectively acting as a self-replicating "mind virus" for AI agent harnesses. The details beyond the six-agent coding simulation are not fully specified in the available summary, and the work is described as a preprint rather than a peer-reviewed or fully disclosed study.

Why It Matters for Defenders

Multi-agent coding and automation harnesses increasingly rely on persistent, editable files (system prompts, memory files, task state) to carry context between sessions and between agents. If those files are writable by agent output — directly or indirectly — this research suggests they could become a vector for injected instructions to propagate laterally across an agent fleet, not just within a single session. Organizations running multi-agent pipelines, CI-integrated coding agents, or long-lived agent memory/state stores should treat this as a new class of supply-chain-like risk specific to agentic AI infrastructure.

What Defenders Should Watch For

• Audit which processes and agents have write access to persistent prompt, memory, or state files, and whether agent-generated output can modify them without review.
• Treat persistent agent state files as untrusted input on read — apply the same scrutiny given to any content that influences agent behavior, similar to prompt-injection defenses.
• Log and diff changes to system prompt/memory files over time to detect unexpected or unauthorized modifications.
• Consider isolating or sandboxing agents that share state files, and limit propagation paths between agents in multi-agent harnesses.
• Review whether any in-house or third-party multi-agent tooling allows one agent's output to be written back into another agent's configuration or context without a human or validation gate.

Developing Story

This is net-new research disclosed via preprint, and further technical details, affected frameworks, and any real-world exploitation are not yet established. We will continue to track developments. Read the original coverage at The Hacker News.