Why it matters
An Anthropic and EPFL preprint tests self-propagating instructions in sandboxed agent chains whose MEMORY.md and SOUL.md files persist across sessions. Writes to the system-loaded soul file produced most propagation attempts and infected the next agent 55% of the time; all four action payloads survived some 20-hop trials. A one-paragraph warning reduced tested spread to near zero, and the researchers found no successful wild propagation in archived Moltbook data.
My takeaway: Treat persistent memory and agent identity files as privileged code, not ordinary workspace notes. Track provenance, restrict which agents can write them, isolate imported state, require approval for cross-agent transfer and destructive tools, and scan for unexpected replication or instruction changes. Preserve a clean reset path because a compromised memory layer can reinfect later sessions.