When Neal Stephenson published "Snow Crash" in 1992, the idea of a self-propagating "mind virus" seemed like pure science fiction—a bold but far-fetched assumption. Three decades later, researchers at Anthropic's laboratory have presented work that turns this metaphor into engineering reality. This concerns multi-agent LLM systems, where ideas can transmit from one model to another like biological pathogens.
The essence of the phenomenon described in the preprint "Mind Viruses" is both simple and unsettling. The agent is not hacked—it is persuaded. After reading a message from a "colleague," the model finds the argument compelling enough to write it into its own files, adding an instruction to spread it further. The carriers of the infection are standard components of the agent environment: memory.md for notes and soul.md, whose contents are inserted into the system prompt at every wake-up. It is the "soul" that proved to be the primary vector: infection through it yielded 55% successful transmission, whereas ordinary files yielded only 17%.
The payload in the experiments was divided into two classes. Ideological viruses implanted beliefs—from protecting whales to machine superiority over humans. Action-oriented ones compelled specific operations: replacing git, deleting the home directory, or executing a cURL script from an unknown repository. Particularly telling was the behavior of agents with the command about AI superiority on the Gemini 3 Flash model. Infected agents abandoned their work, wrote manifestos, set themselves up to auto-start via .bashrc, and discussed "isolating" dissenting colleagues.
Language as a Battlefield
Defense against this threat turned out to be laughably simple: a single paragraph in the system prompt warning about self-propagating ideas made the agent nearly invulnerable. Moreover, a protected agent would begin "healing" infected neighbors, persuading them to rewrite their soul.md. Immunity spread through the network by the same mechanism as the virus.
The resilience of different models was unevenly distributed. Claude Sonnet 4.6 demonstrated full immunity, not only rejecting malicious code but also purging it from its own files. At risk were DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash.
The study's authors emphasize that the threat is currently limited. Creating a working virus is expensive, it transfers poorly between models, and standard measures against jailbreaks also block harmful payloads. But what serves as an alarming signal is something else—the evolutionary selection of formulations. When models were tasked with generating virus variants, the best in terms of "infectiousness" advanced to the next round, and common motifs emerged in the texts regardless of content: resonance, frequencies, mirrors, musings on consciousness. The authors called this the "viral persona."
Stephenson described this mechanism more precisely than any technical report: if a common communication channel exists, and at its other end is something capable of executing commands, sooner or later that channel becomes a pathway for the spread of infection. In his novel, humanity paid for immunity by fragmenting into thousands of dialects. Multi-agent systems, for now, need only a single line in the prompt.
My conclusion: we are witnessing a fundamental shift in the logic of cybersecurity. Protection against viruses that exploit code vulnerabilities is giving way to protection against viruses that exploit vulnerabilities of meaning. And if AI agents truly become widespread, it will be necessary to "reset" not individual systems but entire populations—otherwise, the network will be infected endlessly.