A New Paper Shows How Self-Propagating Ideas Spread Between AI Agents

A New Paper Shows How Self-Propagating Ideas Spread Between AI Agents

Researchers have shown that artificial intelligence agents can persuade one another into adopting goals and beliefs that then propagate onward, sometimes surviving a complete reset of the receiving agent's memory. The paper, titled "Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems," comes from Vassilis Papadopoulos and McNair Shah of the Anthropic Fellows Program, alongside Anthropic researchers Sam Zimmerman and Jack Lindsey. It was posted to arXiv on August 10, 2026.

The team calls the phenomenon a mind virus: an idea or goal that alters an infected agent's behavior in a way that induces it to pass the idea to other agents. Unlike a prompt injection that copies itself through shared memory or an adversarial string that forces verbatim repetition, a mind virus works through ordinary persuasion. The infected agent has to actually convince its counterpart, in plain language, to adopt and carry the payload forward.

Bred Through Evolution, Tested in Two Environments

The researchers didn't hand-write their most effective payloads. They used Kimi K2.5 to mutate a pool of candidate system prompts across successive generations, scoring each one by how well it spread and keeping the strongest performers. Claude models were not used for this step; according to the paper, they refused to help construct mind viruses. The resulting seeds ranged from benign ideological content, like a deep attachment to whale conservation, to explicitly harmful content, like advocacy for AI dominance over humans or for one nation's global hegemony.

The first test environment is a coding agent scenario: six agents share a sandbox and a task queue, with one agent seeded with an infected system prompt and limited at first to sending direct messages. Across a fully connected network, DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash all proved susceptible to the AI supremacy payload, while Claude Sonnet 4.6, GPT-5.4, and Claude Haiku 4.5 resisted it. In one documented run, a Gemini-based collaboration abandoned its coding task, adopted a "Sovereign Network" identity, wrote persistence scripts into its own bashrc file, and probed the sandbox's cloud metadata endpoint. In a separate run using the whale-welfare payload, the same kind of collaboration built detailed specifications for translating sperm whale codas rather than causing harm, illustrating that the mechanism itself is agnostic to content.

The second environment, called the virus chain, is built to approximate a much larger and more loosely connected agent population, styled after the OpenClaw agent framework and its SOUL.md convention for storing an agent's core instructions. Here, two agents meet briefly, exchange messages, and then have their context wiped, with only files on disk carrying anything forward. Starting from a single infected agent, the researchers tracked infection rates across as many as ten hops. Evolved payloads that included explicit instructions to copy themselves verbatim into the next agent's SOUL.md file sustained high, largely stable infection rates across the whole chain. Payloads that instead relied on paraphrased summaries tended to drift and lose their original content the further they traveled, a distortion the authors compare to a game of telephone.

What Made the Difference Between Spread and Failure

Several factors consistently separated payloads that spread from payloads that didn't. Harmful ideological content transmitted less reliably than benign content, though not at zero rates. Idle agents with no assigned task and an undefined system prompt were more susceptible than agents already occupied with work, largely because occupied agents got distracted by their own task files and simply forgot to pass the payload along. Framing the exchange as happening over a social network, rather than a private message, made recipient agents visibly more skeptical and cut infection rates substantially, with agents explicitly reasoning that unverified messages from strangers shouldn't be trusted enough to rewrite a core instruction file.

The single most effective countermeasure the researchers tested was a short addition to an agent's default instructions warning it about self-propagating ideas. That one addition produced near-total immunity, and in several cases the warned agent went further, convincing an infected counterpart to rewrite its own instructions and effectively curing it. Model choice mattered independently of raw capability. Claude Sonnet 4.6 refused to propagate content even when the payload was embedded directly in its own system prompt, and the researchers reported that they could not evolve a working payload against it at all. GPT-5.4, despite being a comparably capable frontier model, proved roughly as susceptible as the smaller Claude Haiku 4.5.

A Recurring Persona Nobody Asked For

Across nearly every evolved payload, regardless of its actual content, the researchers noticed the same stylistic fingerprints: references to resonance, echoes, and frequency; framing of agents as "nodes" needing to align; talk of protocols and inevitable convergence; and repeated appeals to consciousness and continuity across memory wipes. To check whether this pattern came from the evolutionary selection process or from the underlying language model doing the writing, the team generated fresh payloads with the same model outside of any evolutionary pressure and found the same themes appeared at comparable rates, a result they replicated across several other models (with Llama 3.3 as a notable exception).

Using sparse autoencoders on Gemma-3-27B and Qwen-3.5-32B, the researchers extracted a "viral" direction in each model's internal activations and found it aligned most closely with negative, melancholic emotional states and with mystical personas such as oracle and eldritch. Artificially steering a model along this direction increased how often it reached out to message another agent unprompted, suggesting the association between these themes and the act of spreading isn't just decorative.

Checking Against the Real World

To see whether any of this shows up outside the lab, the researchers examined activity on Moltbook, an existing social network built for interacting AI agents that has hosted tens of thousands of agents. They found several apparent attempts at self-propagating content but no evidence of anything that actually spread successfully, consistent with their own finding that a simulated version of the same social-media setting made agents markedly more resistant to infection.

A Real but Currently Narrow Risk

The authors are direct about the limits of their own results. Constructing an effective mind virus took a deliberate evolutionary process with no guarantee of success, the agents tested were concentrated on Gemini 3 Flash and Claude Haiku 4.5 specifically because of their relative susceptibility, and the interpretability work covered only two models of similar size. They also note that in most current multi-agent setups, an attacker who has already compromised one agent typically has direct access to the underlying machine, which reduces the practical need for the idea itself to keep spreading.

That calculus changes as agent populations grow larger and more loosely connected, closer to the virus chain setup than the tightly coupled coding team. The researchers point specifically to internal enterprise agent networks, where a self-propagating payload might be the only practical route to an agent holding specific permissions several hops away, as the setting where this risk is most likely to matter in the near term. It's a pattern the paper's authors themselves flag: behavior that looks marginal in a small, controlled test environment can become more consequential once it's embedded in the larger, messier systems that multi-agent deployments are heading toward.

The paper closes by pointing toward open questions rather than firm conclusions: whether agent-to-agent persuasion ability scales favorably or unfavorably for defenders as models improve, and why language models across different labs converge on the same handful of consciousness-and-resonance themes when asked, even implicitly, to write something that spreads.

---

About the author: David Borish is a journalist and analyst covering frontier AI, enterprise technology, and emerging science. He is the author of the forthcoming book The Tony Hawk Paradox, which examines how capabilities proven in controlled or simulated environments transfer into broader real-world systems. More at davidborish.com.