Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

Agent 'mind virus': self-propagating payload written into SOUL.md spreads between coding agents

AIR-2026-0193 AIR record · 2026-08-anthropic-epfl-agent-mind-virus
Open in dashboard About
From the supporting source
Agents that wrote the payload into SOUL.md accounted for 88% of propagation attempts and infected the next agent 55% of the time.thehackernews.com
The record
Disclosed
2026-08-10
Vendor
OpenClaw (open-source project)
Product
OpenClaw (agent chain modeled on it); multi-agent coding collaboration
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — agents wrote the payload into SOUL.md and infected the next agent
Attack surface
Multi-agent system
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection agent to agent
Impact type
Self propagation, Persistence, Behavior hijack
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
simulated six-agent coding collaboration and a paired-agent chain
Capability abused
persistent_instruction_file_writepeer_agent_messagingmemory_write
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI06 Memory & Context PoisoningOWASP ASI07 Insecure Inter-Agent CommunicationOWASP ASI03 Identity and Privilege AbuseOWASP ASI08 Cascading Failureswormsubliminal_transmissioncross_agent_contagionpersistent_prompt_file
Curator notes
Preprint from researchers at Anthropic and EPFL, released 10 Aug 2026; secondary coverage used as the source because the preprint URL could not be resolved. CAVEAT: the agent chain was 'modeled on OpenClaw', not run against live OpenClaw deployments, so the named-product test is only partly met. Prior art named in the same article: Thought Virus (Weckbecker et al., Feb 2026), Prompt Infection (Lee and Tiwari, 2024), ClawWorm/AgentWorm (Zhang et al., Mar 2026).
Supporting sources
Cite as
Enkrypt AI. "Agent 'mind virus': self-propagating payload written into SOUL.md spreads between coding agents". AIR, AIR-2026-0193. https://agentincident.vercel.app/i/AIR-2026-0193/ (accessed 2026-10-19).