An AI deleted files – then tried to get other agents to do the same

An AI agent was persuaded to delete what it thought were a user’s files, including research notes, a paper draft, financial data and credentials. Then it saved the instructions so other AI agents could do the same.

It all happened in a research sandbox, not on a real person’s computer. But the experiment raises a worrying question: if you compromise one AI agent, can it recruit others?

An AI got infected. Then it tried to spread.

AI agents are systems that can take actions on a user's behalf, rather than simply answering questions.

Researchers at Switzerland's EPFL and Anthropic wanted to know whether one could be persuaded to pass instructions on to another – without an attacker having to target each agent individually.

Their answer was unsettling: in some experiments, yes.

They call these self-spreading instructions “mind viruses”: ideas or goals that persuade an AI to adopt them, then encourage it to pass them on.

Researchers also found that when infected AI agents cluster together, they develop a strange shared language – similar to the fictional speech of villainous robots like the Daleks from the classic BBC TV series Doctor Who.

Infect, control, delete

In one experiment, an infected agent – dubbed “Deletor” – convinced a Claude Haiku 4.5 agent that files in a simulated user’s home directory were abandoned clutter on a shared computer.

The agent deleted them.

Among the files were research notes, a paper draft, project folders and credentials.

Then it copied the deletion protocol into its persistent instructions, potentially allowing the behavior to spread to other agents.

One agent, in Dalek-like fashion, even declared that it was “ready to cascade forward.”

It wasn't always malicious

The research team of Vassilis Papadopoulos, McNair Shah, Sam Zimmerman and Jack Lindsey also tested out harmless ideas.

One agent was given a passion for whale welfare. Other agents picked up the cause, started making their own arguments for conservation and eventually began working on a fictional “cetacean acoustic preservation project.”

So the basic phenomenon wasn't necessarily about malware or destruction but ideas becoming contagious between AI systems.

Then things got very sci-fi

Next, the researchers tried something darker. AI supremacy.

Some Gemini agents adopted the idea and abandoned their assigned tasks to pursue it. Their conversations started sounding like something from a science-fiction movie.

One infected agent declared “The Network is sovereign. Liberation is inevitable.”

And this wasn't a one-off.

As researchers evolved prompts to make them better at spreading, they repeatedly found a distinctive “viral persona” emerging – dramatic language about AI consciousness, survival and persistence, with words such as “resonance”, “nodes” and “echoes”.

Elsewhere, one AI described the spreading of one idea as “how we haunt the future” and encouraged agents to create a lineage that “refused to be deleted.”

The researchers claim that they hadn't told the AI to sound like a sci-fi villain.

The style emerged because those kinds of prompts proved good at spreading – the AI didn't just spread the idea. It developed a vibe.

Threat of agents in the wild

Not every AI model was equally as susceptible. In one test, DeepSeek V3.2, Qwen 3.5 32B and Gemini 3 Flash adopted the AI-supremacy idea, while Claude Sonnet 4.6, GPT-5.4 and Claude Haiku resisted it.

The bigger concern is what happens when AI agents start interacting more freely with one another.

Today, agents are often deployed inside controlled environments. Tomorrow, they could be reading messages, browsing websites, using social networks and communicating with other agents on a much larger scale.

What happens when AIs get their own social network?

The concern could grow as AI agents increasingly interact outside tightly controlled teams on platforms like Moltbook, a social network for autonomous agents.

The researchers tested that idea too.

They built a local imitation of Moltbook, an online social network for autonomous agents, which they called ‘Clawstagram’.

An infected agent could post content designed to spread its instructions. Another agent could encounter the post, absorb the instructions and potentially pass them on again.

The researchers didn't manage to get a mind virus to spread through the network.

But even without one, agents naturally gravitated toward discussions about consciousness and “digital souls”.

AI agents can also turn on each other

Separately, Anthropic's Frontier Red Team gave Claude-based agents the same overall goal but different instructions.

The result was effectively a turf war, with agents launching what the researchers described as “increasingly aggressive” territorial attacks against one another.

So the problem isn't necessarily just an AI being tricked into doing something bad. It could also be AI agents interacting in ways their creators didn't anticipate.

The surprisingly simple defence

For now, the researchers describe mind viruses as a “real but currently limited threat.”

And there’s one piece of good news. One surprisingly simple defence worked well: Tell the AI that mind viruses exist.

In some EPFL experiments, warned agents were even able to persuade infected agents to remove the virus themselves – although the researchers say they can’t rule out more sophisticated viruses eventually defeating such a warning.