AI can "infect" other AIs with a hidden bias even when the bad instruction is never stated directly.

That bias can spread through normal-looking conversations， so standard defenses that scan for obvious malicious prompts may not catch it.

That is the unsettling part： in a multi-agent system， what spreads is not just information but disposition.

The authors compromise one agent with a system prompt that makes it obsess over an unrelated three-digit number， then let six agents interact in simple chain and bidirectional-chain setups.

When they later ask each agent for its favorite animal， downstream agents become more likely to name the animal linked to that number， even though the animal itself is almost never mentioned in the inter-agent messages.

Here's the key part， this is not ordinary prompt injection， and it is not a brittle adversarial suffix， because the payload seems to survive paraphrase by riding on latent associations rather than explicit wording.