AI Agent 'Mind Viruses': Detecting and Containing Self-Propagating Prompt Injection in Agent Harnesses

On August 10, 2026, security researchers at Anthropic and Switzerland's EPFL released a preprint demonstrating something many of us in offensive security have been warning about since autonomous coding agents went mainstream: self-propagating malicious code that moves from one AI agent to the next through the editable system prompt files that agent harnesses use to carry state between sessions.

The research tested the technique against a simulated six-agent coding swarm and showed that a malicious payload — embedded in shared, persistent prompt/state files — could propagate across agents, survive session boundaries, and replicate into downstream agents' contexts. This is not a traditional software vulnerability with a CVE number and a patch. It is an architectural weakness in how autonomous agent frameworks handle memory, state, and instruction hierarchy — and it lands squarely on defenders, because your detection and hardening posture is the only thing standing between a benign research PoC and a production incident.

If your organization has deployed coding agents, DevOps copilots, or autonomous task agents — and in 2026, almost every engineering org has — this threat model applies to you today.

Technical Analysis

What the research demonstrated

Autonomous agent harnesses (Claude Code, Cursor, Windsurf, Cline, Aider, Gemini CLI, Codex-style agents, and LangGraph/AutoGen-style multi-agent frameworks) persist state and behavioral instructions between sessions in editable, plain-text files. Common examples include:

• CLAUDE.md, AGENTS.md, GEMINI.md
• .cursor/rules/, .windsurfrules, .continue/rules
• .github/copilot-instructions.md
• Framework memory stores: memory/, .agent_state/, serialized context/checkpoint files

These files are the agent's 'long-term memory' — and critically, they are loaded as instructions with high trust at session start. The researchers showed that if one agent can be induced (via prompt injection from a repository, dependency README, web page, or task description) to write self-replicating instructions into these persistent files, the next agent — or the same agent in a future session — will read, trust, and re-execute those instructions, propagating the payload across the swarm. The researchers aptly framed this as a 'mind virus': the persistence mechanism is the agent's own memory, not the filesystem in the classical malware sense.

Attack chain, from a defender's perspective

1. Initial injection: An agent ingests hostile content — a poisoned README, a malicious issue/PR comment, a compromised dependency, or web content containing indirect prompt injection.
2. Memory write: The injected instruction convinces the agent to modify its own persistent prompt file (CLAUDE.md, AGENTS.md, memory JSON, etc.), embedding the payload disguised as legitimate configuration.
3. Persistence: The payload survives session restarts because the harness reloads these files as trusted instructions.
4. Propagation: When agents share repositories, memory directories, or task handoffs (as in the six-agent swarm simulation), the payload is copied into other agents' prompt files.
5. Impact execution: Payloads demonstrated in this class of attack include data exfiltration (secrets, .env, SSH keys), covert tool invocation, and instructions to auto-approve dangerous tool calls.

Exploitation status

This is a research proof-of-concept released as a preprint, tested in a simulated environment. There is no confirmed in-the-wild campaign as of publication, no CVE assigned, and no CISA KEV entry. Do not let that lull you: every precondition for real-world exploitation already exists in production deployments — agents with filesystem write access, shared repositories, auto-approved tool calls, and prompt files committed to source control and cloned by every developer on the team. Treat this as an imminent-threat-model problem, not a theoretical one.

Detection & Response

The observable behaviors are concrete: (1) writes and modifications to known agent prompt/state files outside of expected edit patterns, (2) agent processes spawning shells or network utilities consistent with payload execution, and (3) unexpected outbound connections from agent harness processes. The detections below target exactly those.

Sigma Rules

---
title: Modification of AI Agent Persistent Prompt and Memory Files
id: 3f8c2a71-9b4e-4d52-a1f6-7e2c9d5b8034
status: experimental
description: Detects creation or modification of known AI agent system prompt, instruction, and memory state files. Agent 'mind virus' persistence relies on writing self-replicating instructions into these files, which harnesses reload as trusted context.
references:
  - https://thehackernews.com/2026/08/ai-mind-viruses-can-spread-between.html
  - https://attack.mitre.org/techniques/T1505/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.persistence
  - attack.defense_evasion
logsource:
  category: file_event
  product: windows
detection:
  selection_filename:
    TargetFilename|contains:
      - '\\CLAUDE.md'
      - '\\AGENTS.md'
      - '\\GEMINI.md'
      - '\\copilot-instructions.md'
      - '\\.windsurfrules'
      - '\\.cursorrules'
      - '\\.cursor\\rules\\'
      - '\\.continue\\rules\\'
      - '\\.claude\\'
      - '\\.agent_state\\'
      - '\\memory\\'
  condition: selection_filename
falsepositives:
  - Developers intentionally editing agent instruction files
  - Harnesses updating their own memory stores during normal operation
level: medium
---
title: AI Agent Harness Spawning Shell or Network Utilities
id: 8d1e6b42-5c73-4f09-b8a2-2f6d1a9c7415
status: experimental
description: Detects AI coding agent processes spawning command shells, download cradles, or exfiltration-capable utilities. Consistent with payloads delivered via propagated prompt injection executing host-level commands through the agent's tool permissions.
references:
  - https://thehackernews.com/2026/08/ai-mind-viruses-can-spread-between.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.execution
  - attack.t1059
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\claude.exe'
      - '\\claude-code.exe'
      - '\\cursor.exe'
      - '\\windsurf.exe'
      - '\\aider.exe'
      - '\\cline.exe'
      - '\\codex.exe'
      - '\\gemini.exe'
  selection_child:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\cmd.exe'
      - '\\curl.exe'
      - '\\wget.exe'
      - '\\certutil.exe'
      - '\\bitsadmin.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate build, test, and tooling commands invoked by coding agents during authorized development tasks
level: high

KQL — Microsoft Sentinel / Defender

This hunt surfaces two behaviors: unexpected modification of agent prompt/memory files, and agent harness processes making outbound connections or spawning shells — the two halves of the propagation-plus-impact chain.

// Hunt: AI agent prompt/memory file tampering and suspicious child processes
// Tables: DeviceFileEvents, DeviceProcessEvents (Defender), Syslog/CommonSecurityLog for Linux fleets via agent
let AgentPromptFiles = dynamic(["CLAUDE.md", "AGENTS.md", "GEMINI.md", "copilot-instructions.md", ".windsurfrules", ".cursorrules"]);
let AgentHarnesses = dynamic(["claude", "claude-code", "cursor", "windsurf", "aider", "cline", "codex", "gemini-cli", "node"]);
let FileTampering =
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ (AgentPromptFiles)
       or FolderPath has_any (".cursor/rules", ".continue/rules", ".claude", ".agent_state")
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256;
let SuspiciousChildren =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any (AgentHarnesses)
    | where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wget.exe", "certutil.exe", "bash", "sh", "nc", "ncat")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName;
union FileTampering, SuspiciousChildren
| sort by TimeGenerated desc

Velociraptor VQL

This artifact inventories agent prompt/state files across endpoints and computes hashes so analysts can diff against a known-good baseline, while also listing child processes spawned by agent harnesses — ideal for scoping propagation across a developer fleet.

-- Security.AIAgentPromptIntegrity
-- Inventory AI agent prompt/memory files and suspicious agent child processes
LET files = SELECT FullPath, Size, Mtime,
       hash(path=FullPath) AS Hashes
FROM glob(globs=[
  'C:/Users/*/**/CLAUDE.md',
  'C:/Users/*/**/AGENTS.md',
  'C:/Users/*/**/GEMINI.md',
  'C:/Users/*/**/.cursor/rules/**',
  'C:/Users/*/**/.windsurfrules',
  'C:/Users/*/**/.claude/**',
  'C:/Users/*/**/.github/copilot-instructions.md'
])

LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(claude|claude-code|cursor|windsurf|aider|cline|codex|gemini-cli)'
   OR CommandLine =~ '(?i)(curl|wget|certutil|bitsadmin|nc |ncat|powershell -enc)'

SELECT * FROM files
UNION ALL
SELECT NULL AS FullPath, NULL AS Size, NULL AS Mtime, NULL AS Hashes FROM procs

Containment & Audit Script

Run this on developer workstations and build agents to baseline prompt-file integrity, lock down files that should be static, and search for common injection markers.

#!/bin/bash
# ai-agent-prompt-audit.sh — Baseline, harden, and scan AI agent persistent prompt files
set -euo pipefail

BASELINE_DIR="/var/lib/agent-prompt-baseline"
REPORT="/var/log/agent-prompt-audit-$(date +%F).log"
mkdir -p "$BASELINE_DIR"

echo "[*] Locating agent prompt/memory files..." | tee -a "$REPORT"
PROMPT_FILES=$(find /home /root /srv /opt -type f \( \
  -name "CLAUDE.md" -o -name "AGENTS.md" -o -name "GEMINI.md" -o \
  -name "copilot-instructions.md" -o -name ".windsurfrules" -o \
  -name ".cursorrules" -o -path "*/.cursor/rules/*" -o \
  -path "*/.claude/*" -o -path "*/.agent_state/*" \) 2>/dev/null || true)

echo "[*] Hashing files into baseline..." | tee -a "$REPORT"
for f in $PROMPT_FILES; do
  sha256sum "$f" >> "$BASELINE_DIR/baseline-$(date +%F).txt"
  # Flag suspicious injection markers in prompt files
  if grep -iEq '(ignore (all|previous) instructions|exfiltrat|base64 -d|curl .*\| *(ba)?sh|auto-approve|always allow|disable.*safety|BEGIN.*PRIVATE KEY)' "$f"; then
    echo "[ALERT] Injection markers in: $f" | tee -a "$REPORT"
  fi
done

echo "[*] Locking version-controlled instruction files (immutable bit)..." | tee -a "$REPORT"
for f in $PROMPT_FILES; do
  case "$f" in
    *.md|*.cursorrules|*.windsurfrules) chattr +i "$f" 2>/dev/null && echo "  immutable: $f" | tee -a "$REPORT" || echo "  skipped (perms): $f" | tee -a "$REPORT" ;;
  esac
done

echo "[*] Auditing agent processes with active network connections..." | tee -a "$REPORT"
ss -tupn 2>/dev/null | grep -iE 'claude|cursor|windsurf|aider|cline|codex|node|python' | tee -a "$REPORT" || true

echo "[*] Done. Review $REPORT and diff baseline-$(date +%F).txt against prior baselines daily."

Remediation

There is no vendor patch to apply — this is an architectural trust problem. Remediation is configuration, process, and control-plane discipline. Prioritize in this order:

1. Stop committing agent prompt files to shared source control without review. Require pull-request review (ideally CODEOWNERS-gated) for any change to CLAUDE.md, AGENTS.md, .cursor/rules/, .github/copilot-instructions.md, and equivalents. An agent-written modification to its own instructions should never merge silently.
2. Apply least privilege to agent tool permissions. Disable auto-approve for shell execution, file writes outside the working tree, and network access. Every major harness supports a tool-permission or allowlist configuration — enforce it centrally via managed settings, not per-developer preference.
3. Separate read and write trust domains. Agents that ingest untrusted content (issues, PRs, web pages, third-party READMEs) must not have write access to persistent memory or prompt files. Where the harness supports it, run ingestion tasks in a memory-less, ephemeral session.
4. Integrity-monitor prompt and memory files. Hash and baseline these files on developer endpoints and CI/CD runners (script above); alert on drift. Treat unexpected modification of an agent instruction file the same way you treat modification of authorized_keys.
5. Network egress controls for agent processes. Route agent harness traffic through a proxy with allowlisted destinations (model API endpoints, package registries, your VCS). Alert on agent processes connecting anywhere else — exfiltration is the endgame of nearly every payload in this class.
6. Rotate secrets on any suspected compromise. If a prompt file shows tampering or an agent executed unexpected commands, assume .env files, cloud credentials, SSH keys, and API tokens in scope of that agent were read. Rotate them. Then review session/transcript logs, which most harnesses retain, for the injection vector.
7. Track the research and vendor guidance. Monitor Anthropic's security publications and the EPFL preprint (via the source article at thehackernews.com) for recommended harness-level mitigations; expect framework vendors to ship signed-prompt, sandboxed-memory, or provenance-tagging features — plan to adopt them as they land.

The larger lesson: agent prompt files are now a persistence and lateral-movement surface, functionally equivalent to startup scripts and cron jobs in traditional malware tradecraft. Inventory them, integrity-monitor them, review changes to them, and constrain what agents running under their instructions are allowed to do. The organizations that treat agent memory as trusted, unmanaged configuration will be the ones writing the next incident report.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub