A virus that travels by attachments: an attack reaches 60-80% of the assistants and bounces up to eight times

When memory-stricken assistants exchange documents with each other, malicious content slipped into a report is copied from one assistant to another and survives handovers.

Language models are increasingly being deployed as persistent assistants: they retain information from one session to the next and manipulate documents that they read, modify and create. As soon as these documents circulate between users, they constitute an indirect communication channel between otherwise independent assistants. Researchers have explored the failure mode that this channel opens up: an attack capable of propagating itself.

The mechanism described, called artifact-mediated propagation, takes place in four stages: adverse content is introduced via a document, such as a report; it is stored in the assistant's persistent memory; it is reproduced in a document created later; another assistant retrieves it by reading this document. The evaluation is based on human-agent time universes that simulate document exchanges between assistants used separately, by measuring the survival of the attack at relay crossings, the number of jumps reached and the extent of the spread.

The result is clear: the attack crosses several independent assistants and maintains long sequences of interaction. In the largest simulated environments, even GPT-5.6 Luna lets contamination reach 60-80% of agents, with chains of spread of up to eight hops. Persistent documents thus act as enduring carriers of an adversarial state, able to survive the interaction that created them.