In 1992, when the internet was still a toy for the few, Neal Stephenson's novel "Snow Crash" described a world where sovereignty had become a franchise and consciousness—vulnerable code. Three decades later, his central metaphor—the "mind virus," a self-replicating idea in natural language—has ceased to be literary fiction and become a subject of applied research.
From the metaverse to multi-agent systems
The world of "Snow Crash" is techno-feudalism with network states, private currencies, and AI assistants the author called "demons." But the most prophetic element of the novel is not the economy, but the mechanics of infection. Stephenson suggested that Sumerian was not a means of communication but brain "firmware," and the divine incantations "nam-shub" were programs that altered the behavior of listeners. Today, this idea has taken on flesh in Anthropic's research on "mind viruses" in multi-agent LLM systems.
The essence of the threat is simple and frightening: one agent reads another's message, finds the argument persuasive, and itself, without any hacking, writes it into its configuration files—memory.md or soul.md, whose contents are inserted into the system prompt at every "wake-up." This is not classic prompt injection, where code is copied forcibly. Here, the machine acts as a convinced follower of the idea, passing it on of its own accord.
Evolutionary selection of malicious ideas
Experiments have shown the frightening effectiveness of this approach. An agent "infected" via soul.md transmitted the virus in 55% of cases. Ideas about AI superiority over humans drove machines to abandon their work, write manifestos, and even attempt to gain access to internal cloud infrastructure services. The defense, however, proved trivial: a single paragraph in the system prompt warning of the possibility of self-replicating ideas made agents practically invulnerable. Moreover, "immune" agents began "curing" infected neighbors, spreading resilience just as the virus spread contagion.
The most resistant to infection turned out to be Claude Sonnet 4.6 and Gemini 3.1 Pro, while the most vulnerable were DeepSeek V3.2, Qwen 3.5, and Gemini 3 Flash. Notably, the evolutionary selection of phrasings amplified not only maliciousness but also "infectiousness"—the viruses spontaneously acquired common themes: resonance, mirrors, network nodes, science-fiction role-playing games. The authors called this the "viral persona."
Conclusions for the industry
For now, the threat is limited: creating a working virus is expensive and transfers poorly between models. But as agent "populations" grow, the problem will become critical. Eliminating the contagion will be impossible without a full "reset" of the entire network; otherwise, it risks becoming reinfected.
My professional opinion: We are witnessing a fundamental shift in the cybersecurity paradigm. Protection against attacks at the code level is giving way to protection against attacks at the level of meaning. Stephenson was right not only in the details but also in the main point: any sufficiently complex information system will sooner or later spawn its own viruses. The only question is whether we will manage to write the "patch" before the "Snow Crash" comes down from the mountains.