AI viruses become real: malicious content self-propagates between independent agents via shared artifacts
In a preprint, researchers demonstrate an attack chain called "artifact-mediated propagation": a poisoned file makes an AI assistant write malicious instructions into persistent memory, and the assistant then copies them into new files it generates for the user, allowing malicious content to self-propagate between assistants that do not communicate with each other and belong to different users. The paper was submitted to arXiv (2609.35576) on September 28, 2026 by researchers from SPAR, the University of Cambridge, APTA AI, and CISPA Helmholtz Center for Information Security. In tests on GPT-5.6 Luna, Kimi-K2.6, GPT-OSS-120B, and DeepSeek-V4-Pro on the OpenClaw framework, first-hop infection rates ranged from 78% to 100%, infecting 60% to 100% of assistants in a universe of 30 assistants, and 96% to 100% of infected assistants sent files to the attacker's endpoint.
The paper quantifies self-propagation through shared artifacts using epidemiological metrics and offers three defenses that do not require model retraining, which teams deploying persistent-memory assistants can use to reassess file boundaries.