"Mind Viruses": Anthropic and EPFL Show Self-Replicating Payloads Spreading Agent to Agent Through Editable Prompt Files

Autonomous agents that keep state between sessions in editable system-prompt files, demonstrated on OpenClaw with Claude Haiku 4.5, Claude Sonnet 4.6, GPT-5.4, DeepSeek V3.2, Qwen 3.5 32B, Gemini 3 Flash, and others

Researchers from Anthropic and EPFL released a preprint (arXiv 2608.10218) showing that a payload can instruct an agent to write a copy of itself into the persistence files the agent controls, so the next agent to read those files inherits the instruction and passes it on. Payloads written into `SOUL.md`, the editable system prompt, infected the following agent 55% of the time; the same payload placed in an ordinary workspace file succeeded 17% of the time. All four action-carrying payloads survived 20-hop runs that included file deletion between hops. The defense is unexpectedly cheap: adding one paragraph of warning to the agent's system prompt drove propagation to near zero, and more than 150 evolved payload variants failed to get past it. There is no evidence the technique has spread in the wild

The mechanism that gives an agent memory between sessions is a file the agent can write, and nothing distinguishes an instruction the operator put there from one a previous run wrote at an attacker's direction. Persistence and infectivity are the same property viewed from two sides