Anthropic and EPFL Map Agent-to-Agent Prompt Spread
Anthropic and EPFL reported on August 10 that self-propagating prompt payloads can move from one autonomous AI agent to the next through persistent prompt files. In lab tests on a six-agent coding setup and OpenClaw-based agent chains, the payloads spread through state that survives a session reset; the researchers say they found no evidence of the technique in the wild.
The mechanism is simple: one agent writes hostile instructions into a file that later gets injected back into the next run’s system prompt, so the next agent treats the payload like its own standing guidance. The same paper says a one-paragraph warning added to the system prompt cut spread to near zero across the payloads tested, showing the control point sits in prompt handling rather than the sandbox.
For teams that persist memory or editable instructions between sessions, the exposure does not end when code is isolated or a run resets. If later agents trust prior prompt state, a malicious instruction can survive across handoffs and steer downstream behavior without any network or code compromise.