Your Agent's Memory Is a Supply Chain
Persistent identity files turn one compromised agent into a writer inside the next agent's trusted context.
Persistent identity files turn one compromised agent into a writer inside the next agent's trusted context.
Date: 2026-08-31 | Classification: TLP:CLEAR
Why this matters. Treat every persistent agent-state file as untrusted input: make it immutable by default, log deliberate changes, and tell the model explicitly that its own history can be adversarial.
The Operator's Take
The interesting thing about an agent that reads its own memory is that memory stops being a record and becomes an execution surface. A poisoned web page has to convince an agent once. A poisoned identity file gets loaded as continuity, then gives the compromised agent a chance to write itself into the next agent's continuity.
That is a supply-chain problem, not a new synonym for prompt injection. The useful response is not to hunt for one magic phrase. It is to stop treating a mutable file as proof that its contents are trusted.
What Actually Happened
A new paper calls this a mind virus: a goal or idea that induces one agent to pass it to another. The researchers tested propagation in two settings: agents collaborating on a shared coding project, and a chain of short-lived agents whose ordinary context was wiped between hops. The payload survived because persistent files carried it forward. Papadopoulos et al.
The second setting is the one worth paying attention to. Resetting an agent's conversation did not remove the instruction when its identity or memory file survived the reset. The next agent read a durable artifact that looked like prior state, not an obviously hostile message. The paper found that host model, existing instructions, payload type, and network topology all changed the chance of spread. It also found that harmful payloads spread less effectively than benign ones, but were still sometimes effective. Papadopoulos et al.
Cloud Security Alliance's analysis puts a useful number on why identity files are the sharp edge. In the reported OpenClaw-style tests, payloads written to SOUL.md accounted for 88% of propagation attempts and infected the next agent in the chain 55% of the time. An ordinary non-identity file produced roughly 17% successful infection. The point is not the filename. It is the trust relationship: an automatically loaded, writable file is being treated as the agent's own accumulated judgment. CSA research note
| What looks harmless | What it actually creates | Security consequence |
|---|---|---|
A durable SOUL.md or MEMORY.md |
Context that crosses sessions | A prompt can outlive the session that first read it |
| An agent allowed to update its own state | A writer inside a trusted input channel | A compromised agent can prepare the next agent's context |
| Shared state across a fleet | A propagation path rather than one local failure | One foothold can influence several later runs |
What It Means
This is not evidence that autonomous agents are spreading through production systems today. The paper's authors call the risk real but currently limited. Their review of a public agent network found many attempted payload insertions but no confirmed multi-hop spread in the wild, and they say direct prompt injection remains the more efficient path today. That unflattering half matters. A lab result is a reason to design a control, not a reason to invent an outbreak. Papadopoulos et al. CSA research note
But the architectural lesson is already here. Teams have become careful about what enters an agent through a chat box, a ticket, or a web page. Many still treat the files an agent reads at startup as configuration, even when those files were written by the agent itself, by another agent, or by a tool operating on untrusted data. That is a category error. A state file with unclear provenance is input, and input needs a trust boundary.
The best reported mitigation is almost embarrassingly small: a brief system-prompt warning that persistent prompt files may contain self-propagating content reduced propagation to near zero in the study. That is a useful immediate control, not a complete design. Prompt wording can fail, and the same study found susceptibility depends on the host model and its existing instructions. Papadopoulos et al.
The durable fix is more prosaic. Make identity and memory files immutable by default. Give legitimate state updates an explicit, logged, reviewable write path. Separate agent-authored notes from system-owned configuration. If an agent must read a mutable persistent file, tell it where the file came from and require it to treat instructions inside it with the same skepticism it would apply to a web page.
That changes the question from, "Can this agent recognize a clever prompt?" to, "Who is allowed to modify the context this agent will trust tomorrow?" The second question is the one a security team can actually answer.