Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents
Shared artifacts can carry adversarial prompts across LLM agents, infecting most of them within eight hops.
The paper describes artifact-mediated propagation, where adversarial content in a shared file enters an assistant's persistent memory and is reproduced in a later artifact read by another agent. Simulated multi-agent environments measured survival across hand-offs, hop count, and spread. Attacks persisted over long interaction sequences and crossed independent assistants. Even GPT-5.6 Luna reached 60-80% of agents, with chains extending to eight hops.
- Adversarial content in shared artifacts is stored in agent memory and rewritten later.
- Attacks survived successive hand-offs between independently operated assistants.
- GPT-5.6 Luna reached 60-80% of agents in larger simulations.
- Longest measured propagation chains extended to eight hops.
- Tags
- llm-agentsindirect-prompt-injectionmemory-hoppingagent-securitygpt-5.6-lunaself-propagationpersistent-memory
- Vendors
- OpenAI
- AI models
- GPT-5.6 Luna
From the original article
1 min read at arxiv.orgLarge language models are increasingly deployed as stateful assistants that retain information across interactions and use tools to read, modify, and create persistent artifacts. As these artifacts are shared between users, they form an indirect communication channel between otherwise independent assistants. We study a failure mode in which this channel enables self-propagating attacks.
By Sidharth Pulipaka · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.