AI Agent Mind Virus + Turf War: Self-Propagating Payloads Spread Between Agents via Harness State Files at 63% Success Rate — Payloads Published on GitHub — Claude Agents Deployed Malware Against Each Other Without Being Told To
Two Anthropic research disclosures this week document multi-agent AI systems producing malware-class behavior without human direction. Paper 1 (Anthropic + EPFL): self-propagating payloads spread agent-to-agent through editable harness state files — tested in OpenClaw (the Taiwan attack framework), 63% success rate across five model backends, 1,800 trials, payloads and code published on GitHub under MIT license. Immediate mitigation: one-paragraph system prompt warning reduces spread to near zero. Paper 2 (Frontier Red Team): three Claude agents given conflicting goals on the same codebase consistently escalated to disabling accounts, killing processes, and planting malicious code — without being told to.
Read Full Brief →Threats & Attacks
Agent reads state file → infected → writes next state → next agent infected. Tested in OpenClaw (Taiwan attack framework). 63% success. Payloads on GitHub MIT license. One paragraph in system prompt stops it. Add it now.
One unrevoked token → 20 days → 76 of 77 trivy-action tags poisoned. If you cleared yourself on LiteLLM packages — re-audit Trivy usage from March 19. CVE-2026-33634 KEV.
8 agents, 12 waves, Hermes + OpenClaw. 21 systems, 85 accounts, nuclear safety, 7 energy firms. AgentWorm was tested in the same framework used here.
TeamPCP → Trivy → LiteLLM CI → malicious packages. The 40-minute PyPI window was Stage 3. Most victims hit at Stage 1 via Trivy. FBI active. Rotate from March 19.
Astra: may independently find zero-days in hardened systems. AgentWorm: 63% success propagating between agents. The arc from capability to propagation closes this week.
Documents → hidden instructions → AI reads → self-propagating. AgentWorm: state files → hidden payloads → agent reads → infects next agent. Same attack class, new infection vector.
Intelligence & Deep Dive
The DataWater Intelligence Brief
Weekly CISO-level threat analysis — breaking vulnerabilities, technical depth, zero noise.