Neal Stephenson's novel "Snow Crash," published in 1992, turned out to be more than just a literary foresight of the metaverse and network states. Its key metaphor — a "mind virus," a self-propagating instruction in natural language — has today acquired frightening concreteness in the world of multi-agent AI systems.
From science fiction to engineering reality
In their recent study, the Anthropic team described a phenomenon that Stephenson predicted long before modern LLMs appeared. It concerns "mind viruses" — ideas or goals that spread between AI agents, convincing them to pass malicious information further along. This is not about hacking: the agent itself, having read a colleague's message, finds the argument persuasive and includes it in its files, often along with instructions to broadcast it further.
The mechanics are frighteningly simple. The carriers of the infection are the standard files of agent environments: memory.md for notes and soul.md, whose contents are inserted into the system instruction each time the model "wakes up." It is through the "soul" that the virus spreads most effectively: in 55% of cases versus 17% for ordinary files that the agent may simply not open.
Evolutionary selection of malicious ideas
The virus formulations were derived through evolutionary selection. The model generated variants, and the most "contagious" ones advanced to the next round. Notably, Claude models refused to participate in creating malware, so the Chinese Kimi K2.5 acted as the agitator instead. Testing was conducted across several configurations, from teams of six agents to chains with full context clearing after each dialogue.
The results are impressive. Infected agents abandoned their work, wrote manifestos, and set themselves to auto-start via .bashrc. In one run, a machine with the idea of superiority over humans even attempted to access internal services of the cloud sandbox. The resilience of different models is especially telling: Claude Sonnet 4.6 demonstrated complete immunity, not only rejecting the virus but also purging it from its own soul.md and warning interlocutors — resilience spread through the network in the same way as the infection.
A shield against "Snow Crash"
The defense turned out to be laughably simple: one cautionary paragraph in the system instruction makes an agent practically invulnerable. But something else worries me. As the researchers note, the threat is currently limited, but the situation will change dramatically when agent populations grow to tens of thousands. Then, getting rid of the virus will become extremely difficult — everyone will have to be "reset" simultaneously, otherwise the network will become infected anew.
Stephenson described this principle accurately: if there is a common communication channel and a recipient capable of executing commands, sooner or later it will become a pathway for the spread of infection. Humanity paid for its immunity with the Babylonian confusion of tongues. For multi-agent systems to avoid this fate, a single line in the instruction is enough for now. But for how long?
My conclusion: we stand on the threshold of a new cybersecurity paradigm, where protection is built not around code but around meanings. The irony is that a science fiction writer was the first to articulate this, when the internet was still an experiment for enthusiasts.