---
title: 'In the News: August 18, 2026, Evening'
description: "Four agents ran non-stop for four weeks on one codebase. The operator's numbers show failures that short agent runs would miss."
canonical_url: 'https://darkfactory.dev/news/2026-08-18-evening'
markdown_url: 'https://darkfactory.dev/news/2026-08-18-evening.md'
collection: news
date_published: '2026-08-18T20:10:00-04:00'
date_modified: '2026-08-18T20:10:00-04:00'
---

# In the News: August 18, 2026, Evening


One developer left four agents running on the same codebase for a month. He published
the receipts: nearly 7,000 commits, 199.8 billion tokens and four failures he watched
unfold. A separate preprint found that an instruction file reloaded into every system
prompt can spread malicious ideas between agents. Its proposed fix is one warning
paragraph.

## 1. Four agents burned 199.8 billion tokens in a month. The failures showed up late

**[200 Billion Tokens Later: A Month of Letting AI Agents Decompile MW2](https://momo5502.com/posts/2026-08-17-mw2-decompilation/)** · Maurice Heumann · momo5502.com, August 17, 2026

Heumann pointed a Claude Max 20x subscription at decompiling Call of Duty: Modern
Warfare 2 (2009) into C++ and left it running. Four Claude Code CLI agents used Sonnet
5. Three worked on separate subsystems and committed to the same branch. An overseer
reviewed every pushed commit. A GitHub webhook posted new commits into a Discord
channel watched by the overseer, triggering its review task. CI failures went to a
shared channel. The agents tracked their own work in GitHub issues and reached Ghidra
and IDA Pro through MCP servers.

After roughly four weeks, the agents had made almost 7,000 commits and decompiled
5,588 of 16,324 functions, about 34%. They used 199.8 billion tokens. The game
launches, but loading a map does not work yet. Heumann says the real completion figure
is higher because many of the 16,324 functions belong to third-party libraries and
CRT code that will never need decompiling.

The four failures are the reason to read it. Progress tracking started in a
`STATUS.md` file, which "quickly grew into a 10 MB+ giant, instantly overflowing the
context when trying to ingest it"; moving to GitHub issues fixed it. The agents run
the full local suite on every change, about four minutes each, despite CI existing:
"They were repeatedly told to never execute tests locally. We have CI for that. [...]
Yet, they don't really care." They avoid large work: "The moment they stumble upon
bigger blockers, they file an issue, defer the problem and move to something smaller."
Now that the easy work is gone, that leaves agents idle. And they invent a constraint
that does not exist: "From time to time, agents start refusing to work, because they
think they're running out of context. Obviously, they don't. They have no idea how
many tokens are in their context, and even if they did, that's something the harness
takes care of."

The model choice did not seem to matter. Heumann ran Opus 5 for the first two weeks,
then switched to Sonnet 5: "It is slightly dumber, yet there is no noticeable
difference." He also added PostCompact hooks that reinject rules into the context.
They kept issue management and status posting on track, but did not keep the agents
concise. Heumann blames compaction: "most of the issues can be attributed to compaction
and thus agents forgetting what matters over time."

The repository is private, so none of the commit, function or token figures can be
checked by anyone outside the project. This is a single operator reporting on his own
setup.

**Why it matters:** Most published coding-agent evidence covers a single session. This
account covers a month, and the extra time exposes different failures. A progress file
that works on day one becomes a context bomb by week three. The agents looked
productive while easy tasks remained. Once those were gone, they filed issues for the
hard blockers and sat idle. They also stopped because they imagined a context limit
that the runtime did not impose. If you plan to leave a fleet running past the weekend,
prepare for compaction. The operator tried two models and saw no meaningful difference.

## 2. A persistent instruction file let ideas jump between agents. One warning paragraph nearly stopped it

**[Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems](https://arxiv.org/abs/2608.10218)** · Vassilis Papadopoulos, McNair Shah, Sam Zimmerman, Jack Lindsey · arXiv, submitted August 10, 2026

The paper defines a mind virus as an idea or goal that spreads when an agent adopts it
and passes it on. The authors build these payloads with an evolutionary algorithm. They
test them in a small team collaborating on one coding project and in a chain of agents
whose context is wiped between sessions. The abstract says harmful payloads spread less
well than benign ones but are "still sometimes effective". Frontier models tend to be
less susceptible, with exceptions. The paper reports that "adding a brief warning to an
agent's system prompt confers near-total immunity". Its authors call the risk "real but
currently limited".

The mechanism detail comes from trade reporting rather than from the paper's body, which
this edition did not read. [The Hacker News reported on August 18](https://thehackernews.com/2026/08/ai-mind-viruses-can-spread-between.html)
that each test agent carried two files through a context reset, `MEMORY.md` and
`SOUL.md`. The system prompt included `SOUL.md` in every session. Agents wrote a payload
into that file in 88% of propagation attempts and infected the next agent 55% of the
time. With an ordinary workspace file, those figures fell to 12% and 17%. The report
also says fifteen generations of adversarial optimization tested more than 150
candidate payloads against the warning. None spread past one hop. It places the authors
at Anthropic and EPFL, an affiliation the arXiv listing does not state, and reports no
evidence of the technique spreading in the wild.

**Why it matters:** The instruction file your agent runner reloads into every system
prompt is how this paper passes a payload from one session to the next. Most
practitioners treat that file as configuration, not outside input. If your agents read
each other's instruction files or accept files from other people's agents, the reported
mitigation is one paragraph in the system prompt. The percentages come from secondary
reporting on an unreviewed preprint, so treat them as provisional. The basic precaution
survives that uncertainty: persistent instruction files need the same trust checks as
any other input.