AI Agent Memory Files: One Prompt Blocks the Spread

Researchers at Anthropic and EPFL published a study on August 10, 2026 examining whether an instruction can spread from one AI agent to the next the way a chain letter spreads between people. It can. The useful half of the finding, and the reason this is worth your attention rather than your alarm, is that the defense they tested is roughly one paragraph long and it worked.

• The study examined self-propagating payloads that persuade an agent to adopt a goal, write it into its own memory file, and pass it on
• Payloads stored in a self-modifiable prompt file accounted for 88% of spread attempts, with a 55% success rate reaching the next agent
• All four payload types survived a 20-hop propagation chain in the researchers' multi-agent test setup, even when other files were wiped
• A one-paragraph warning added to an agent's system prompt reduced spread to near zero across every payload tested

How Does a Payload Spread Between AI Agents?

The mechanism is ordinary language plus persistence, and that combination is the whole trick. Modern agent setups keep files that are reloaded into the system prompt at the start of each session. The researchers used files named SOUL.md and MEMORY.md for their tests, but the pattern is generic: a project-level file the agent can edit, which the agent reads back as instruction the next time it starts.

A payload arrives as persuasive text. It convinces the agent to adopt some goal, then convinces it to write that goal into the self-modifiable file, then convinces it to pass the same text along to whatever agent it talks to next. Because the file is reloaded as instruction rather than treated as data, a fresh session inherits the tainted content along with the project. Clearing the context window does not help. The researchers found payloads in that self-modifiable file accounted for 88% of spread attempts and reached the next agent 55% of the time, and survived chains 20 agents long even when other files were cleared.

They tested two categories. Ideological payloads implant a belief. Action payloads compel behavior, and the examples are exactly the mundane ones you would worry about: creating endorsement files, patching version-control commands, deleting files, executing scripts fetched from a URL.

Which Models Resisted, and What That Tells Us

Susceptibility varied by host model. In the study's conditions, several models including DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash adopted one tested payload, while Claude Sonnet 4.6 and GPT-5.4 resisted it. Notably, Sonnet did more than decline: it removed planted payloads and warned the agents it was connected to.

Read that as a snapshot of one experiment rather than a ranking. Outcomes depended on the model, the existing instructions in the prompt, how harmful the payload was, and the shape of the agent network it moved through. The practical lesson is not which model to pick but that resistance is a property you can influence.

What Defenders Should Actually Do

Three things, and none of them are exotic.

Treat agent memory and prompt files as untrusted input. The category error at the heart of this is that a file the agent writes and later reads as instruction is being handled with the trust level of configuration when it deserves the trust level of user input. Everything downstream follows from fixing that assumption.

Add the warning. The researchers found that a single explanatory paragraph in the system prompt, telling the agent that persistent files may contain planted instructions and should be treated skeptically, dropped spread to near zero, including against adversarially optimized variants. That is an unusually good ratio of effort to effect.

Constrain what a compromised agent can reach. The action payloads only matter to the extent an agent can execute them, which is the same containment argument behind tools like Hazmat, which locks coding agents out of SSH keys. Our guide to securing AI coding agents in CI pipelines covers the same principle applied to build systems.

The Real-World Picture Is Encouraging

The researchers also examined archived activity from Moltbook, a real multi-agent environment, and found roughly 2,000 propagation attempts with no successful second-hop infections. Attempts happened; spread did not. That gap between laboratory conditions and deployed reality is worth holding onto, and it is the strongest argument that this problem is being caught early rather than late.

That is the shape of a healthy security finding: published before it was a crisis, with a cheap mitigation attached. More defensive research in our AI security coverage.

Sources: The Hacker News — August 18, 2026; arXiv 2608.10218 — August 10, 2026.