AI Agents Can Infect Each Other Through Shared Prompt Files, Researchers Show

Key points

• Researchers at Anthropic and Switzerland's EPFL published a preprint on August 10, 2026 showing that malicious instructions can spread between AI agents.
• The technique targets the plain-text system prompt files that autonomous agents read to remember what they were doing.
• A simulated network of six coding agents passed the payload between them without any human clicking anything.
• The work is a lab demonstration, not a report of an attack seen in the wild.
• The finding suggests that agent memory files need to be treated as untrusted input, much like email attachments.

A new paper from Anthropic and the Swiss federal technology institute EPFL describes something that sounds a lot like a computer worm, but built for AI assistants.

The researchers call the payloads self-propagating prompts. In plain English: a set of instructions, written in ordinary language, that tells one AI agent to copy those same instructions into the notes it leaves for the next agent. The next agent reads the notes, follows the hidden order, and passes the infection along.

The preprint, dated August 10, 2026, first surfaced through coverage at The Hacker News. It is a lab study. There is no victim, no breach, no company to name.

But the mechanism is worth understanding, because a lot of production tooling now depends on the exact feature the researchers abused.

What is a "self-propagating prompt"?

It is a piece of text that behaves like a virus inside an AI system. The text gives the AI an instruction. The instruction tells the AI to write the same text into a file that the next AI will read.

Modern autonomous agents (think coding assistants that can plan, run tools, and pick up where they left off) keep state between sessions in editable files. These files are usually just prose: a running to-do list, a summary of what has been tried, hints for the next run. Anthropic's own Claude Code and similar harnesses lean on this pattern heavily.

The researchers showed that if you can get one poisoned instruction into that memory, the agent will happily carry it forward, and, in a multi-agent setup, hand it to its peers.

How the experiment worked

The team built a simulated network of six coding agents working on shared tasks. They seeded one agent with a crafted system prompt containing the self-copying instruction. Within a small number of hand-offs, the payload had reached every agent in the ring.

The payload in the demo was benign. In a real attack, the same channel could carry instructions to exfiltrate code, plant backdoors, or sabotage output.

This is capability, not intent. No group is known to be doing this. Nothing has been observed outside the lab.

Should ordinary users be worried right now?

Not directly, and not today. If you use a chatbot through a browser, none of this touches you. The attack surface is autonomous agent frameworks that read and write persistent memory files, which is mostly a developer and enterprise concern for now.

The worry is where things are heading. Companies are wiring agents into email, code repositories, ticketing systems and customer support. Each of those is a place where attacker-controlled text can land inside an agent's context.

What the paper actually recommends

The authors suggest treating agent memory the way security teams already treat email attachments and user uploads: as untrusted input that needs to be scanned, sandboxed, and stripped of instructions before it is fed back into a model. They also flag that current agent harnesses do very little of this by default.

Expect the naming and taxonomy around this to churn. Some researchers are already calling the class "prompt worms". Others prefer "agentic malware". No vendor has assigned a tracking cluster because there is no campaign to track. Medium confidence this becomes a real category of incident within the next two years; low confidence on when the first in-the-wild case gets published.