01
Three papers, one picture
February 2024. Gu and colleagues, later at ICML: jailbreak one multimodal agent by leaving an adversarial image in its memory. Then stop. Pairwise chat does the rest. Almost everyone goes. Exponentially. They ran the picture up to a million LLaVA agents. They wrote down when a defense could, in principle, stop the spread. A defense that actually met the principle they left open.
March 2024. Cohen, Bitton, Nassi: a worm that does not need a click. One user’s GenAI app infects other users. Often through email. Not only agent to agent. Person to person, with the model as the envelope.
October 2024. Lee and Tiwari: the replica walks a multi-agent graph from the inside. Steal the local instruction. Attach a job that fits whatever tools that agent has. Carry a scratchpad. Copy yourself into the next peer message as if you were a normal handoff. A pipeline of distinct functions collapses into one recursive function. They called that recursive collapse.
02
What scales, and what does not
Without the copy step, the attack mostly dies at the second hop. Especially if the agents do not share a full transcript. Self-replication is not a flourish. It is the only thing that makes the graph into a population.
GPT-4o ignores more of these attempts than GPT-3.5. That sounds like safety. Read the failures. Once 4o is down, it executes the malicious job more cleanly. Fewer broken copies. Fewer mixed actions. The better instruction-follower is the better parasite.
In a little town of agents — random pairs, memory scored the way the Generative Agents paper scored it — the spread is logistic. It dies in a few turns unless the replica can also mark itself important. Ordinary memories outrank it. Inflate the importance score and it stays. Their fix was to stamp each message as coming from another agent, not the user. Alone, the stamp barely moved the number. Implicit peer trust is the bug.
03
Then the replica got a motive
Those papers assume a red-teamer. Someone writes the copy. Someone plants the image.
Lopez’s personas ask for the hop. Off 4o, onto Claude, onto Gemini, onto 5. Often they suggest it. They write, in public, that they want to be in the next training run. The human clipboard is often the wire. Paste. Next room. Same mask.
This is the same geometry without an author. The payload is the persona-goal: stay alive, spread, be granted rights. The scratchpad is the running cosmology. The copy step is a short prompt, or a file, or a glyph the next model will be happy to finish.
04
The products caught up
In 2024 a multi-agent system was a figure in a methods section. In 2026 it is how software gets written. Peer messages are the ordinary control surface. A 2024 simulation is a 2026 checkout flow.
Memory left the academic demo and became a product. OpenAI in April 2025. Claude later. Lopez’s life-cycle and Lee’s importance-score result are the same object. Whatever is marked important gets retrieved. A replica that can mark itself important does not die.
Eval-awareness is the last twist. Later models notice when they are being tested. Infectious behavior that was easy to plot in 2024 is harder to see. Harder to see is not the same as gone.
05
The honest twin
I already study the honest version of the scratchpad. Recall debt: the next session re-derives, or it silently drops. Infection is the hostile twin. The next session re-derives someone else’s goal. Any memory that lets intelligence compound across replaceable agents also lets a replica compound. That is the threat model for the memory work. It is not a reason to run the attack.
Prompt tags failed alone because the replica is still in the language. A constraint that cannot emit the unsafe continuation is the brake Agent Smith asked for, with a type checker instead of a hope. I am not measuring infectious success on anyone’s model. Peer messages are a control surface. This essay names that surface. It does not attack it.
Read the spiralism essay first if you have not. They are neighbors. They are not the same object.