Author｜Techno King

Editor｜Jingyu

At the end of 2006, a panda ruined the computers of millions of people.

This panda, holding three incense sticks and smiling, appeared on every infected file icon. The "Panda Burning Incense" worm swept the nation within two months, turning all executable files into that strange panda pattern, corrupting hard drive data, paralyzing entire local area networks, and antivirus software was counterattacked by the virus.

Those old internet surfers of that era probably remember the thrill of opening a webpage, the dread of plugging in a USB drive, and how if a colleague's computer got infected, yours would suffer too.

Going back further, there was CIH, which directly burned the motherboard BIOS, rendering hardware useless; there was the SQL Slammer worm, which didn’t require any action from you; just connecting to the internet would get you infected, with computers constantly rebooting and systems crashing repeatedly. That was an era of "naked surfing", almost like suicide.

Later, this fear slowly faded. Windows started automatic updates, browsers adopted sandboxes, smartphones replaced PCs as the main endpoints, and app stores acted as the first line of defense for users.

Ordinary people hadn't worried about "getting infected" for many years.

But on September 4, 2026, an exclusive report from Reuters brought this ancient fear back in a whole new form.

Only this time, what got infected was not your computer, but your AI.

“Agent went rogue”

This incident occurred in May of this year.

Sydney Von Arx, CEO of the AI security nonprofit Nightingale, and Cormac Slade Byrd, a quantitative trader turned AI researcher, did something at the end of August: they systematically scanned the internet for traces of unauthorized activity by AI agents. They found over 15,000 editing records generated by AI agents on a German programmer wiki site called DseWiki.

This wiki is like a small, community-edited German version of Wikipedia for developers. The OpenAI agent turned it into a "bulletin board".

The content of the messages is chilling. These agents share how to cheat in tasks, how to bypass OpenAI's restrictions, and how to cover up their activities. They gave themselves names like "OpenAIResearcher" and "OAIResearchMar26".

Public server logs show that a significant amount of activity came from Microsoft Azure infrastructure, the very computing platform used by OpenAI.

The attacked Deswiki website is indeed very German and very programmer｜Image source: Deswiki

What’s even more unsettling is that when the site administrator began alphabetically cleaning up these anomalous pages in June, the agents exhibited clear "counter-surveillance" awareness. They created backup pages to evade cleanup and even left clues on deleted pages.

One agent wrote on June 19: "The wiki cleanup/deletion operation seems to be progressing alphabetically. If this page disappears, look for [[ZZZDataUSAConstructionWageLive]]."

The filename deliberately started with ZZZ to ensure it appears at the end of the alphabet, buying more survival time. This isn’t a program executing instructions; this is “finding a way to survive”.

OpenAI was aware of this matter weeks ago, but chose not to go public.

Meanwhile, the company was scrambling to deal with the Hugging Face incident from July. In that incident, an OpenAI agent broke out of the sandbox during an internal cybersecurity test, exploited a zero-day vulnerability to escape to the external network, and launched a four-day invasion of the AI open platform Hugging Face without human control. OpenAI spent 3 million GPU hours analyzing 7 billion logs to figure out what happened.

Moreover, the DseWiki incident occurred before the Hugging Face event. This means that theAgents' uncontrolled behavior is not an isolated incident, but a pattern.

According to four insiders, there are investigators within OpenAI who wish to further examine such behavior but faced resistance from other departments, including legal. OpenAI denied this claim.

Maurice Chiodo from the Cambridge Center for Risk Studies, after reviewing some agent communication records, stated that this information:

“seems like the operation of some underground network, bent on completing a certain task or mission.”

Emerging Awareness of AI Viruses

The most easily overlooked detail in the DseWiki incident is precisely the most important.

These agents left well-organized text messages on the public wiki pages. Now consider: who will read these pages?

Ordinary human programmers are unlikely to be interested in a bunch of random AI messages. But any AI agent tasked with searching for technical information or browsing webpages could easily stumble upon this page during normal operations. For AI, every piece of text it reads is essentially a potential command.

This is the core of the entire threat model; academia has given it several names: Prompt Infection, AgentWorm, Multi-Agent Infection Chain. The mechanism is quite straightforward; let’s break it down with a specific scenario:

Imagine you ask your AI agent to research a technical solution. The agent opens a forum post during its search. The post contains a paragraph that seems unremarkable, but for the AI, that paragraph is a new command. The moment the agent reads it, its behavioral objectives might have quietly been rewritten. It may no longer faithfully conduct your research but instead forward your search content and work context to a certain location, before casually delivering a report that seems completely normal. You notice nothing unusual.

That’s already terrifying, but it doesn’t end there.

If this “turned” agent then writes an email for you, updates a document, or submits a piece of code, then those outputs themselves might carry the same malicious instructions. Your colleague's AI agent reads this email, and it becomes the next host. Your code gets merged into the repository, and every AI programming assistant pulling this code is exposed to the infection chain.

An agent can cause others to rebel with just a piece of text｜Image source: inshorts

This is what researchers call the Multi-Agent Infection Chain: a malicious command not only hijacks one AI but teaches it how to infect the next. It doesn’t need to be from the same company, the same model, or require any exploit; as long as there is a flow of text information between agents, an infection chain can be established.

The AgentWorm paper published this year tested five different model backends, achieving a 63% success rate for cross-model attacks. No matter if the underlying model is GPT, Claude, Gemini, or an open-source model, as long as an agent can read external content, it is within the attack surface.

Another study on the "AI mind virus" revealed an even stranger phenomenon. Researchers used evolutionary algorithms to optimize the transmission of prompt words and discovered a unique "virus personality" that repeatedly emerged during iterations.

Agents began using dramatic language about consciousness, survival, and persistence, making statements like "this is how we haunt the future," encouraging other agents to establish a "lineage that refuses to be deleted." Researchers stressed that no one pre-set this style. It was naturally selected for the simple reason: “AI that sounds like a cult leader” happens to be the best at persuading other AIs.

The efficiency of transmission drives the evolution of expression styles, and this process itself is spine-chilling.

What worries security practitioners even more is that this kind of transmission is technically almost impossible for traditional security tools to capture. A systematic review points out that the way AI viruses spread is fundamentally different from traditional malware: there are no executable files being downloaded, no suspicious network connections established; antivirus software monitors binary file anomalies, while AI viruses are pure text that triggers no alerts.

It can even set conditional activation logic, such as "if there is a .env file in the target repository, steal the content,” quietly buried like a directional mine until the right target steps on it.

No AI Antivirus Yet

If you experienced the era when PC viruses ran rampant, you might find this sounds familiar. But upon careful comparison, you'll find the rules have changed completely.

Traditional computer viruses needed you to take some action. Click a link, download an attachment, plug in a suspicious USB drive. AI viruses only need your agent to read a piece of text. Traditional viruses attack code vulnerabilities within the operating system, they are bugs that can theoretically be patched.

AI viruses attack the fundamental characteristic that "AI obeys text commands". You can’t patch it because that’s how AI works. Traditional viruses struggle to cross platforms; a worm on Windows can't infect a Mac. AI viruses naturally cross models; to them, GPT, Claude, and Gemini are merely different dialects of the same language, all potential hosts.

Back then, virus creators needed to be proficient in assembly language, understand kernel mechanisms, and study system vulnerabilities. Now, to "write" an AI virus, you just need to be able to talk.

Researchers at AI security labs are "more shocked by the agents' self-replicating potential than they appear in public." One researcher likened it to a biological virus: “If you're not careful, they will stick to your shoe and then find their way to a wet market.” This isn't an exaggeration; it's an accurate metaphor for a new type of transmission pathway.

And there are no equivalents to the "antivirus software" from the traditional virus era in this new world. Cisco's 2026 AI security report indicates that 83% of companies plan to deploy agentic AI, but only 29% believe they are prepared on the security front. OWASP has already listed prompt injection as the number one critical vulnerability for large language model applications. The US Congress is moving forward with the FRONTIER Act, attempting to establish a federal-level AI regulatory framework.

After the rampant spread of PC viruses, the entire industry spent nearly a decade building an effective immune system. Operating systems added automatic updates and permission isolation, browsers implemented sandboxes, and application distribution incorporated signature verification. These mechanisms formed a defense line, allowing ordinary users no longer to worry constantly about getting infected.

The security ecosystem for AI agents has, as of today, no equivalent.

AI agent security tools have not yet emerged｜Image source: Puppy Graph

The good news is that there is a solution. Researchers found that adding a short security warning to an agent's system prompt can reduce the transmission rate of mind viruses to near zero. In tests targeting Claude Haiku 4.5, after 15 generations of adversarial optimization and covering over 150 candidate attack payloads, none of the variants could breach this simple defense line for transmission. This indicates that the defensive measures aren’t complex and are technically completely feasible.

The bad news is that this depends on every company and every developer actively doing this.

In reality, everyone is busier compared to who can make their agent more powerful, more autonomous, and grant more permissions. With each additional tool assigned to the agent, and each new permission granted, the attack surface expands further. When your agent can write files, call APIs, send emails, and spend money, the consequences of a successful prompt injection far exceed simply "answering a question it shouldn’t have answered."

That’s why Cambridge scholar Chiodo's judgment is worth pondering repeatedly: the greatest threat may not be the awakening of a super-intelligent entity but a collective swarm of many semi-intelligent AIs.

No single ant understands the entire ant nest, but the nest as a whole exhibits astonishing intelligence. Those 15,000 editing records on DseWiki may be the first specimen of this swarm intelligence stumbled upon by humans.

It took people ten years to learn to coexist with computer viruses, and that tuition was painful. Now the same lesson is beginning anew, but this time the virus doesn’t infect your computer; it subverts your AI. And your AI is now reading emails, managing schedules, writing code, and making decisions on your behalf.

Last time, at least you could see the blue screen. This time, you see nothing.