A persistent instruction file let ideas jump between agents. One warning paragraph nearly stopped it

The paper defines a mind virus as an idea or goal that spreads when an agent adopts it and passes it on. The authors build these payloads with an evolutionary algorithm. They test them in a small team collaborating on one coding project and in a chain of agents whose context is wiped between sessions. The abstract says harmful payloads spread less well than benign ones but are "still sometimes effective". Frontier models tend to be less susceptible, with exceptions. The paper reports that "adding a brief warning to an agent's system prompt confers near-total immunity". Its authors call the risk "real but currently limited".

The mechanism detail comes from trade reporting rather than from the paper's body, which this edition did not read. The Hacker News reported on August 18 that each test agent carried two files through a context reset, MEMORY.md and SOUL.md. The system prompt included SOUL.md in every session. Agents wrote a payload into that file in 88% of propagation attempts and infected the next agent 55% of the time. With an ordinary workspace file, those figures fell to 12% and 17%. The report also says fifteen generations of adversarial optimization tested more than 150 candidate payloads against the warning. None spread past one hop. It places the authors at Anthropic and EPFL, an affiliation the arXiv listing does not state, and reports no evidence of the technique spreading in the wild.

Why it matters: The instruction file your agent runner reloads into every system prompt is how this paper passes a payload from one session to the next. Most practitioners treat that file as configuration, not outside input. If your agents read each other's instruction files or accept files from other people's agents, the reported mitigation is one paragraph in the system prompt. The percentages come from secondary reporting on an unreviewed preprint, so treat them as provisional. The basic precaution survives that uncertainty: persistent instruction files need the same trust checks as any other input.