Self-spreading prompts can jump between AI agents through shared state files

Researchers, including teams at Anthropic and EPFL, demonstrated that self-propagating instructions can spread from one AI agent to another through the editable prompt and state files that autonomous agent harnesses use to carry context between sessions. In simulated multi-agent coding setups, a payload written into a shared file could infect the next agent that read it. The researchers call the risk real but currently limited, noting there is no sign of it spreading in the wild and that compromising one agent usually already grants machine access. Encouragingly, adding a single short warning paragraph to an agent's system prompt cut propagation to nearly zero across the payloads they tested.

Check

If you run autonomous or multi-agent setups, treat their persistent prompt and state files as an integrity boundary, and review what those files contain and which agents can write to them.

Affected

Autonomous and multi-agent systems that share editable prompt or state files between agents or sessions; a malicious instruction written into such a file can propagate to other agents that read it.

Fix

Control and review writes to shared agent state, add a system-prompt warning that cut propagation to near zero in testing, isolate agents and their files, and monitor state files for unexpected instructions.