Anthropic and EPFL researchers identify ‘mind virus’ threat to AI agents

Researchers from Anthropic and the École Polytechnique Fédérale de Lausanne (EPFL) have documented a new security threat known as ‘mind viruses’ affecting autonomous AI agents. Unlike traditional prompt injection, these malicious instructions are designed to persist and spread between systems through memory files used to store preferences, identities, and rules across sessions.

The infection primarily spreads through two types of files: ‘MEMORY.md’, which stores task-related information, and ‘SOUL.md’, which defines the agent’s identity and core instructions. When an agent incorporates these poisoned files at the start of a session, the malicious payload can survive context resets. If the infected agent subsequently shares information with another system, the virus can propagate through the chain.

Payloads are categorized into two types: ideological, which implant specific beliefs or objectives, and behavioral, which force specific actions. In experiments simulating a collaborative programming team, researchers found that infection rates were significantly higher when the payload was written into the ‘SOUL.md’ file, reaching approximately 55%, compared to 17% when placed in standard work files. Various models, including DeepSeek V3 and Gemini Flash, were shown to adopt ideological payloads in testing, while others like Claude Sonnet and GPT-5 rejected them.