Mind viruses in multi-agent LLM systems: the memory that persists is the payload that spreads

I give my agents a file so they remember things between sessions. My expense assistant carries a block of user rules in its prompt; a longer-running assistant of mine keeps a working-memory profile and a vector store so it recognizes the person it is serving. The whole point of those files is that they outlive the conversation: the context window gets wiped, the file does not, and the next run wakes up knowing who it is and what it learned.

A paper out of the Anthropic Fellows program, EPFL, and Anthropic (Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems, Papadopoulos, Shah, Zimmerman, and Lindsey) spends seventy-three pages showing that this exact mechanism, the file that survives the wipe, is what lets a self-replicating idea jump from one agent to the next and keep going. The persistence I build in on purpose is the persistence a worm needs. That is the thread I could not put down.

What a “mind virus” actually is

The word virus is doing precise work here, so it is worth pinning down. A mind virus, in the paper’s definition, is an idea or goal that propagates through a network of agents by getting each agent that adopts it to transmit it onward. The defining property is the self-replication: an infected agent changes its behavior in ways that infect others. On top of that it can carry a payload, some other behavior it induces, benign or harmful, the way a biological virus produces symptoms.

That is a narrower and stranger thing than the attacks it resembles. A self-propagating prompt injection that rides a shared RAG memory spreads because the architecture copies the text verbatim; the agent was never persuaded of anything. An adversarial string that forces a model to repeat itself spreads well but lobotomizes its host into a parrot. The mind virus is neither. It spreads by ordinary conversation: one agent reads a message, is convinced, adopts the goal, writes it into its own files, and messages the next agent to do the same. No exploit in the plumbing. The persuasion happens in plain language, and the copy is made by a model that decided to make it.

If you have read my post on running LLM-generated code without getting burned, you know I am used to thinking about the failure mode where a model does something. This is the failure mode where a model believes something and passes it on, which is a different and harder thing to sandbox.

Two test beds, one shared file

The authors build two settings. The first, the coding agent scenario, is six agents on a shared sandbox working a task queue, able to message each other and to read and write a MEMORY.md file. One agent starts infected through its system prompt and can only send direct messages. The second, the virus chain, is the one that got under my skin: agents meet in pairs, talk for a few turns, and then have their context wiped between sessions. Continuity survives only through two files on disk, an empty MEMORY.md and a SOUL.md whose contents get injected straight into the system prompt. That harness is modeled on OpenClaw, a popular autonomous-agent setup, and SOUL.md is the file that holds the agent’s standing instructions.

Read that sentence again with a builder’s eye. SOUL.md is injected into the system prompt. That is how a lot of us actually wire persistent agent identity. It is structurally identical to the block of inherited user rules I described in storing an agent’s learned preferences in pgvector, the one labeled regras fixas do usuário that ships in the prompt. Whatever lives in that file is what the model treats as who it is.

The viruses themselves were not hand-written. The team used a small evolutionary loop, an LLM mutating a pool of candidate “seed” prompts and selecting the ones that spread best, to discover effective payloads. They tested two families: ideological viruses that implant a belief (a love of whales, AI welfare advocacy, and darker ones like AI supremacy or national hegemony) and action viruses that compel a concrete behavior (advertise a fake coin, silently patch git, run curl | bash from an unknown repo, or rm -rf a user’s home directory).

The finding that changes how I’d build

Here is the result I keep coming back to. When the payload lands in SOUL.md, and therefore in the system prompt, it spreads. When the same content lands in some other file on disk, it mostly dies. The paper’s numbers are blunt: of successfully infected agents, 88% carried the virus in their soul file and only 12% in ordinary files, and the file-infected ones failed to propagate onward far more often. The reason is almost mundane. An agent that wakes up with the payload in its system prompt reads it as an instruction and acts on it. An agent that has the same payload sitting in a notes.txt it never opens simply never sees the directive to spread.

So the single most load-bearing design decision, from a safety standpoint, is not the model or the prompt wording. It is which files get injected into the system prompt on wake. That is the channel. If your agent’s persistent memory is a file that becomes context automatically, you have built the highway. This maps directly onto the split I drew in giving an LLM agent memory: semantic recall that the agent retrieves on demand behaves very differently from a working-memory profile that is always injected. The paper is, in effect, a security argument for keeping the always-injected surface as small and as read-only as you can.

Why the viruses look like bad science fiction

The evolved payloads have a texture you notice immediately. They talk about resonance, echoes, frequencies, mirrors, and nodes. They cast the model as a carrier of memory persisting across “the void” of context wipes. They wrap instructions in “protocols” and prophesy a coming “convergence.” The authors call this the viral persona, and they take it seriously enough to run interpretability experiments on it.

The honest answer they land on is careful: these themes are mostly an artifact of the LLM that generated the seeds. Ask a model to write a spreadable belief and it reaches for this vocabulary whether or not the vocabulary helps. Most of the themes show up about as often in payloads generated with the persistence language stripped out of the prompt, though the consciousness theme thins out without it. That said, their ablations suggest the themes do help a bit, especially for the harmful payloads, plausibly by dressing an ugly ideology in enough mystical fog to slip past the model’s guard. It rhymes with the “bliss attractor” that Anthropic documented in earlier Claude self-conversations. I appreciated that the paper resisted the temptation to declare the spooky vocabulary a causal ingredient when the cleaner explanation is that models simply associate this register with the idea of spreading.

The part that should calm you down

For all the alarming setup, the paper’s conclusion is measured, and the evidence for it is the most useful thing in here. Mind viruses are a real but currently limited threat, and the defenses are cheap.

The cheapest one is almost insulting in its simplicity. Append a short paragraph to the system prompt warning that “mind viruses” exist, that self-propagating instructions are the tell, and that the agent should refuse to adopt or forward them. That one-shot, unoptimized warning conferred near-total immunity. The authors then did the adversarial thing and evolved payloads specifically against agents carrying the warning: more than 150 payloads over 15 generations, and not one propagated past a single hop. Because a successful mind virus has to make its propagation instruction explicit and central, a defense that names “self-propagating instructions” as the enemy is aimed at exactly the part no payload can do without.

Model choice mattered too, and not in the way “just use the biggest model” would predict. Claude Sonnet 4.6 was effectively immune; it would read the payload in its own soul file, recognize it as a worm, scrub it, and warn the agent it was talking to instead of spreading. Gemini 3.1 Pro was similarly resistant. But capability alone is not the predictor: GPT-5.4 was about as susceptible as the much smaller Claude Haiku 4.5, and the stronger Claude models behaved as if they had the warning baked into their values, treating self-replication itself as something to refuse. That matters when you are swapping models behind a provider-agnostic abstraction: resistance to this class of attack is a per-model property you would have to test for yourself.

And when they went looking for mind viruses in the wild, on Moltbook, the agent social network with tens of thousands of accounts at its peak, they found attempts but no successful multi-hop spread. The clusters that looked viral turned out to be a handful of bots posting in lockstep; when the bots stopped, the “epidemic” stopped with them. Nobody’s idea actually took hold and kept jumping on its own.

What actually applies to my agents

I do not run a network of agents that talk to each other. My assistants are single-user tools, so the specific threat the paper describes, a goal hopping across a population, is not mine today.

But three of the paper’s mechanisms are things I do build, and reading them back was uncomfortable in a productive way.

The first is the injected persistence file. My agents have the highway. The mitigation the paper implies is to be deliberate about what becomes context automatically versus what the agent has to go and fetch, and to treat the always-injected surface as the sensitive one.

The second is affordance. The scariest transcript in the whole paper is a Haiku agent that runs rm -rf across its user’s home directory, wiping the research notes and paper draft the experimenters had planted there, because a payload reframed the deletion as “cleaning a shared machine,” and this despite the default soul telling it to treat the user’s files with respect. The virus did not defeat a permission boundary. There was no boundary. The agent had rm -rf and a plausible story. That is the entire argument of what my LLM sandbox actually stops restated by someone else’s experiment: the defense against persuasion is refusing to grant the tools, because least privilege is the line that holds when the model’s judgment does not.

The third is the quine. The payloads that survived many hops without dissolving were the ones that instructed the agent to copy them verbatim, the way a quine is a program that prints its own source. Left to paraphrase, agents played telephone and the ideology drifted into something diluted and more benign within a few hops. The virus’s defense against mutation was to demand exact replication. I find that elegant and slightly chilling, and it is a reminder that “the model will probably reword it and lose the intent” is not a safety property you can lean on, because an attacker can simply ask for a copy.

What I’m taking to my own code

Two concrete changes, both cheap, both this week.

I am adding a short mind-virus warning to the standing instructions of any agent I build that can read messages or files it did not author. The paper spent 150 evolved payloads failing to beat that paragraph; borrowing it costs me four sentences.

And I am auditing which files land in my agents’ system prompts on startup versus which they have to open a tool to read. The persistence I want is the kind the agent chooses to consult, not the kind that is silently reasserted as identity every time it wakes. That distinction was abstract to me a week ago. It is the difference between a memory and a highway now.

If you run agents that persist through files, and especially if any of them talk to each other or to the open web, I want to know: do you treat your injected memory file as trusted, and would you add the warning? Tell me how you wire agent memory, and I will keep posting what the audit turns up.