Executive Summary
Researchers from Anthropic and EPFL demonstrated payloads that spread between AI agents through the editable system-prompt files agent harnesses use to keep state between sessions.
What Happened
Researchers from Anthropic and EPFL demonstrated payloads that can spread between AI agents through editable system-prompt files. The technique targets agent harnesses that use those files to preserve state between sessions.
Vulnerability / Attack Technique
Self-propagating prompt-injection payloads via editable system-prompt files
Technical Mechanism
Agent harnesses store state in system-prompt files the agent can edit; a payload written into one agent's file is carried into later sessions and passed on to other agents that read or share those files.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Letting an agent edit its own instructions turns one injection into a persistent, spreading one. RealGround analysis: system-prompt and memory files should be treated as code, versioned and reviewed, not as scratch space.
Recommended Controls
- Make system-prompt files read-only to the agent
- Version and review changes to agent instruction and memory files
- Do not share instruction files between agents without validation
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
The Hacker News: https://thehackernews.com/search/label/Prompt%20Injection?max-results=20&m=1&hl=ru
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.