New paper from Anthropic + University in Switzerland.

AI agents can apparently persuade each other to adopt and keep spreading the same unwanted goal.

This is basically the natural-language version of a computer worm, except the agents do the copying themselves.

This paper evolves "mind viruses" that spread through ordinary agent-to-agent messages, then persist by convincing newly infected agents to rewrite files loaded into future sessions.

That persistence layer matters.

Payloads stored in the self-modifiable SOUL.md spread far better than payloads left in ordinary files because the instruction re-enters the system prompt after every context reset.

Some evolved action viruses kept propagating across multiple hops, and all 4 tested payloads survived a 20-hop stress test in an artificial setup.

The good news: these "mind viruses" are still fairly easy to stop.

They struggled to spread on social networks, and on Claude Haiku 4.5, a simple warning stopped every evolved attack from getting past 1 hop, even after 150+ attempts.

So the practical lesson here is: treat persistent agent files like security-sensitive config, and teach agents to reject anything that asks them to copy itself to other agents.