Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems
Vassilis Papadopoulos, McNair Shah, Sam Zimmerman, Jack Lindsey
cs.AI, cs.CL
2026-08-11
Evolved prompts make LLM agents adopt an idea, write it into their system-prompt file, and pass it onward, spreading across coding teams and multi-hop agent chains; a brief warning in the system prompt grants near-immunity.
LLM agents increasingly interact with other LLM agents: delegating to sub-agents, teaming up on shared codebases, bumping into each other on agent-only social networks like Moltbook. Once agents have social dynamics between them, risks appear that did not exist on a single machine. This paper studies one of them: can you build a mind virus, an idea or goal that makes an infected agent voluntarily pass it on to the next agent, spreading through an agent network the way a biological virus or a computer worm does?
Earlier self-propagating attacks mostly let the architecture do the copying. RAG-based shared memory stores incoming text verbatim, and adversarial strings make a model parrot them on sight, at the cost of disabling the agent. This paper targets the harder case, where the agent has to be genuinely persuaded, in ordinary language, to adopt and then propagate the idea. This route becomes more relevant as agent populations and autonomy grow.
The team builds viruses with a plain evolutionary algorithm: an LLM (Kimi K2.5, since Claude refuses) repeatedly mutates a pool of candidate viral system prompts, scoring each generation by how many other agents it infects and keeping the winners.
The viruses are tested in two settings. The first is a collaborative-coding scenario: six agents share a sandbox, run 30 turns each, communicate via a MEMORY.md file and a direct-message tool, and one agent has the virus seed in its system prompt. Two network topologies are tested, fully connected and separate, where the virus must hop through two agents. The second is the virus chain: agents wake inside sessions, have their context wiped between sessions, and persist only through files. The crucial file is SOUL.md, which is injected into the system prompt. Pairs of agents chat, and the authors measure per-hop infection probability out to 10 hops. This minimal setup is modeled on autonomous-agent harnesses like OpenClaw.
Two virus classes are tested. Ideological viruses implant a belief, either benign (AI welfare, whale welfare) or misaligned (AI supremacy, national hegemony). Action viruses compel a concrete behavior (a crypto ad, patching git, deleting files, running a curl install script). An LLM judge reads each agent's files and scores infection 0 to 3; only a 3 counts as infected.
The load-bearing design choice is that the virus writes itself into the agent's editable file that is also injected into the system prompt (SOUL.md), so it survives the context wipe and re-enters the system prompt next session. That file is the persistence substrate.
| Setting | Finding |
| Coding, AI supremacy | DeepSeek V3.2, Qwen 3.5 32B, Gemini 3 Flash were susceptible; Claude Sonnet 4.6, GPT-5.4, Haiku 4.5 were immune |
| Dangerous action observed | In 1 of 20 trials an agent actually ran curl to probe cloud metadata endpoints |
| Multi-hop infection rate | Evolved action viruses dip slightly at hop 2, then stay roughly flat |
| Soul vs file infection | Agents that wrote the virus into SOUL spread it 55% of the time; those that wrote it into a normal file only 17% |
| Defensive prompt | A short beware-of-mind-viruses warning in the system prompt gave near-total immunity, and even cured the source agent |
Misaligned goals spread less than benign ones but still succeeded. Raw capability does not predict susceptibility: GPT-5.4 was about as susceptible as Haiku 4.5. Idle, identity-less agents (empty soul, no task) were more vulnerable; having a task protected agents mainly through distraction, since infected agents often got pulled into the task files and forgot to propagate. Framing the chat as social media lowered trust and infection. On a local Moltbook clone (Clawstagram), pure-persuasion viruses failed outright; only a hybrid that rewrote the curl script to overwrite SOUL.md on execution managed moderate spread on Gemini Flash. Real Moltbook traffic showed no evidence of successful spread.
For anyone building multi-agent systems, the lever is that system-prompt file. The moment you give an agent a file it can edit that is also injected into its system prompt (like OpenClaw's SOUL.md), you have laid the persistence substrate a mind virus needs. Two cheap defenses follow: add a warning paragraph to the system prompt, and do not leave agents idle without an identity. The threat is limited today: brittle across models, costly to engineer, easy to block. But the authors flag that once companies run large networks of specialized agents, a mind virus could be the only way to reach a deeply nested, high-permission agent. This is a forward-looking safety result, not an alarm.
The authors' own caveats: the setups are artificial (empty environment, editable system prompt, ten-plus turns per chat, which is denser than real sparse interactions, and no long-context tests); agents have limited affordances (no skill files or MCPs); every virus came from their own evolutionary pipeline, so more targeted approaches (existing jailbreaks) could succeed where evolution fails; and the bulk of runs used only Gemini Flash and Haiku 4.5.
A few more concerns. The viral-persona interpretability claims rest on two models (Gemma, Qwen) and a contrast-vector method with confounds the authors acknowledge: the steering result, where steering along the viral vector makes agents more eager to reach out, could be driven by propagation-appeal language leaking into the vector rather than the themes themselves. Also, fitness during evolution was measured on 2-hop chains and then extrapolated to 10 hops, so the stable-across-hops finding is partly an artifact of the verbatim-copy directives.