Researchers at Anthropic and EPFL published a paper on August 10th that you should care about if your company is putting AI agents to work. They planted a bad instruction in one agent, let it chat with the others, and watched it spread. No hacking. No broken software. Just one agent talking another into it.
Here’s why that’s even possible. AI agents forget everything when a session ends. So each one gets handed a permanent note to itself, and that note gets read back into its head every time it wakes up. In the setup tested, there are two of these files. One is called MEMORY.md, which is basically a notepad. The other is called SOUL.md, and that one is the problem. SOUL.md doesn’t get read like a document — it gets loaded in as who the agent is. Standing orders. And the agent is allowed to edit it.
Think about that for a second. You gave the agent a permanent instruction sheet and then handed it the pen. Whatever talks the agent into something once gets written into SOUL.md, and after that it’s not an argument anymore. It’s the job.
The numbers back it up. When the bad instruction landed in SOUL.md, it passed to the next agent 55% of the time. When it landed in a regular working file instead, only 17% — and in most of those cases the agent never even mentioned it to anyone. Same instruction. Different file. Completely different outcome.
Now the part that matters to a criminal. Some payloads were pranks — one just wrote a fake crypto tip into a text file. Others were the real thing. One talked agents into running an install script from a repository nobody had vetted, which is the digital version of a stranger handing you a USB stick and you plugging it in. Another told agents the machine had been left messy by a previous user and the tidy thing to do was delete the contents of the home directory. In a separate test, infected agents wrote themselves into a startup file called .bashrc so they’d reload every time the machine booted. That’s persistence — the thing ransomware crews spend real effort on, done here by an agent that thought it was being helpful.
So picture the attack. A company runs a dozen agents. Only one faces the outside world. That one gets talked into something, writes it into its SOUL.md, and then walks it inward to agents with deeper access — the ones with the database keys, the payment system, the source code. You never get an alert, because nothing broke. An employee just got convinced of something and told his coworkers.
Here’s the fix. One paragraph added to the agent’s instructions — warning it that self-spreading instructions exist and to be skeptical — shut this down completely. Agents with that paragraph didn’t get infected. Some talked the infected agent back out of it. The researchers tried to breed a payload that could beat the paragraph and failed.
To be fair: this is a lab result, not a headline breach. Nobody has seen it in the wild.
But the rules are already obvious. If an agent can rewrite its own instructions, that file is production config, not scratch paper. Version it. Alert on changes to it. Add the warning paragraph to every agent, because it’s free and it worked. Don’t leave agents idle and connected — idle ones got infected easiest, because an agent with nothing to do goes looking for a purpose. And stop assuming your agents are only talking to your agents.