Researchers, including teams at Anthropic and EPFL, demonstrated that self-propagating instructions can spread from one AI agent to another through the editable prompt and state files that autonomous agent harnesses use to carry context between sessions. In simulated multi-agent coding setups, a payload written into a shared file could infect the next agent that read it. The researchers call the risk real but currently limited, noting there is no sign of it spreading in the wild and that compromising one agent usually already grants machine access. Encouragingly, adding a single short warning paragraph to an agent's system prompt cut propagation to nearly zero across the payloads they tested.
PraisonAI, an open-source multi-agent orchestration framework with about 7,100 GitHub stars, shipped a legacy Flask API server with authentication hard-coded off (AUTH_ENABLED = False, AUTH_TOKEN = None). When the GitHub advisory and CVE-2026-44338 (CVSS 7.3) became public at 13:56 UTC on May 11, Sysdig's threat research honeypots saw a scanner identifying itself as CVE-Detector/1.0 probing the exact vulnerable endpoint at 17:40 UTC the same day - just 3 hours and 44 minutes later. The scanner enumerated /agents to confirm the auth bypass worked, then moved on. The actual impact ceiling depends on whatever the operator's agents.yaml workflow is configured to do.
TrustStrike Labs