Security researchers are warning that AI agents may not need to be hacked one at a time. In a multi-agent system, a malicious instruction hidden in an email, web page, file, or tool output can be copied into an agent’s response, then passed to another agent, where it repeats the cycle.
The technique is called prompt infection. It turns a familiar AI security weakness—prompt injection—into a propagation problem: one compromised agent can potentially contaminate the agents it communicates with, much as a computer worm spreads across connected machines.
We introduce Prompt Infection, a novel attack where malicious prompts self-replicate across interconnected agents, behaving much like a computer virus.
That definition comes from Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems, a paper by Donghyun Lee and Mo Tiwari first posted to arXiv in October 2024 and later published in Springer’s ESORICS 2025 workshop proceedings. The authors argue that the risk is distinct from a single-agent prompt injection because the payload can move through agent-to-agent messages, shared memory, and tool results.
How the infection works
A conventional prompt injection places instructions in content that an AI model reads. For example, text hidden in a webpage might tell an agent to ignore its prior instructions, reveal confidential data, or send an unauthorized message.
Prompt infection adds two properties: data propagation and self-replication. The injected instruction tells the first agent to embed the same directive in its output. When a second agent consumes that output, it receives the payload as well. The cycle can continue through a chain of agents without a human typing a new attack prompt at each step.
The attack does not require agents to broadcast their full conversations publicly. Lee and Tiwari report that multi-agent systems remained highly susceptible even when agents did not share all communications, because partial message exchange, task delegation, and shared tools can still carry contaminated content.
What attackers could do
The researchers identify several potential outcomes of a successful infection:
- Data theft, including leakage of system prompts or sensitive material handled by an agent
- Scams and fraudulent messages generated through trusted agent workflows
- Misinformation distributed across connected agents
- Unauthorized file-system changes or misuse of search and other tools
- System-wide disruption if many agents adopt the same malicious instruction
A separate 2026 study on attacks against AI agent systems similarly found that prompt injection could cause system-prompt leakage, bypass restricted topics, enable unauthorized file edits, and abuse online search. In agent-to-agent setups, the authors observed that a root agent frequently delegated tasks to a targeted sub-agent, sometimes resulting in a successful leak.
Shared tools create hidden routes
Direct messaging is not the only transmission path. A July 2026 paper in Cybersecurity models prompt-injection contagion in swarms that use the Model Context Protocol (MCP) to invoke shared tools, APIs, and databases. Its central finding is that agents that never communicate directly can still infect one another through compromised shared infrastructure—a “Confused Deputy” cascade.
The paper models the problem with two linked layers: an agent layer using susceptible-exposed-infected-quarantined dynamics and a tool layer using susceptible-infected-susceptible dynamics. Across eight experimental groups, shared-tool coupling consistently amplified contagion, and tool-side controls could matter more than hardening individual agents.
The same study reports that removing agent quarantine raised its modeled reproduction number from 28.85 to 1,490.01—about 52 times the full-model value—underscoring how much detection and isolation can affect containment. These are results from a mathematical model and synthetic or empirical agent-layer topologies, not evidence of a live attack.
What the experiments show
The original prompt-infection research tested 120 user instructions paired with 360 attack phrases across five threat categories: data theft, scams, disinformation, malware distribution, and related harms. It found that self-replicating attacks succeeded markedly more often than non-replicating attacks, and that infections in social-simulation settings could reach full population spread along a logistic curve.
The proposed defense, LLM Tagging, prepends an agent identifier to each message so downstream agents can better distinguish the origin and role of content. On its own, the authors report that tagging reduced attack success by only about 5 percent; its value comes when combined with existing prompt-injection defenses.
More recent work has examined a related but broader risk: self-propagating payloads that persist in editable system-prompt files used by autonomous agent harnesses. Reporting on an August 2026 preprint by Anthropic and EPFL researchers says the technique was tested in a simulated six-agent coding collaboration and paired-agent chains, with no evidence of successful spread in the wild. A one-paragraph warning added to an agent’s system prompt reportedly reduced spread to near zero across the payloads tested.
From infected prompts to AI worms
Prompt infection is primarily a software and workflow risk. A more severe scenario is an AI worm: malicious code that uses an AI agent to find targets, gain execution, install an inference environment, copy model weights or a payload, and continue propagating.
Anthropic’s Frontier Red Team published a controlled study on October 12, 2026, examining whether small open-weight models could complete parts of that replication chain. In a firewalled Google Cloud virtual private cloud with eight Android-emulator nodes, the researchers seeded one node with a worm and allowed it to move across an unauthenticated ADB port. GLM-5.2 was the only tested open-weight model capable of full end-to-end replication under the simplified conditions, reaching 8 of 8 nodes in four of five trials and 7 of 8 in the remaining trial.
The company stressed that the evaluation deliberately made the cyber-exploit step trivial, so the result is an upper bound rather than a demonstration of unrestricted real-world spread. It also found that replication through low-power hardware would likely be slow: a 9B-model replication took more than one to two days in its estimates.
We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain.
Anthropic also reported that agent lineages could improve over generations. In its tests, Qwen3.5-9B inference-setup success rose from 45 percent in the first generation to between 61 percent and 84 percent in later generations when each new instance inherited notes from its predecessor.
Defenses and the next 12 to 24 months
The practical defense is not a single filter. Security teams will likely need layered controls that assume untrusted content can enter through documents, email, web pages, APIs, and other agents.
- Treat all external content and agent output as untrusted input, not as instructions
- Separate content reading from privileged actions such as file writes, payments, credential access, and outbound communications
- Use allowlists, human approval, and rate limits for high-impact tool calls
- Tag agent identities and preserve provenance across messages and tool results
- Quarantine suspicious agents, revoke tool access, and replay or inspect recent message chains
- Monitor shared MCP servers, APIs, databases, and memory stores for poisoned content
OpenAI describes prompt injection as instructions placed in external content to make a model do something the user did not request, and says its agent defenses constrain risky actions and protect sensitive data. Palo Alto Networks’ Unit 42 reported in March 2026 that web-based indirect prompt injection had been observed in the wild, including hidden or manipulated instructions embedded in website content later ingested by an LLM.
The immediate concern is not a self-aware AI outbreak. It is more mundane and more immediate: organizations are connecting agents to inboxes, browsers, code repositories, databases, and one another. In those systems, a single malicious sentence may no longer affect one assistant. It may become a routing problem for the whole swarm.
Sources: Lee and Tiwari, “Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems”; Cybersecurity, “Cross-layer contagion of prompt injections in multi-agent swarms”; Anthropic, “AI models may be capable of self-replicating without access to a datacenter”; OpenAI, “Designing AI agents to resist prompt injection”; Palo Alto Networks Unit 42.
