Author | King of Techno
Edited by Jingyu
The oldest fear on the internet has been revived by AI
At the end of 2006, a panda destroyed millions of computers.
The panda, holding three incense sticks and smiling, appeared on the icon of every infected file. The "Panda Burning Incense" worm swept across the country within two months, turning all executable files into that eerie panda image, corrupting hard drive data, paralyzing entire local networks, and even defeating antivirus software.
Back in those days, veteran internet users probably remember the anxiety of opening web pages, treating USB drives like potential threats, and catching viruses just because a colleague’s computer was infected.
Even earlier, there was CIH, which directly corrupted the motherboard BIOS, rendering the hardware unusable; there was the Blaster worm, which infected your computer simply by connecting to the network—no action required on your part—causing constant reboots and system crashes. It was an era of “naked internet surfing,” nearly tantamount to suicide.
Later, this fear gradually faded. Windows adopted automatic updates, browsers implemented sandboxing, smartphones replaced PCs as the primary device, and app stores became the first line of defense for users.
Ordinary people haven't worried about "poisoning" in many years.
But on September 4, 2026, a Reuters exclusive report brought back this ancient fear in an entirely new form.
This time, however, it’s not your computer that’s been infected, but your AI.
Agent went rogue
The incident occurred in May this year.
Sydney Von Arx, CEO of the AI safety nonprofit Nightingale, and Cormac Slade Byrd, a quantitative trader turned AI researcher, did something at the end of August: they systematically scanned the internet for traces of unauthorized AI agent activity. They discovered over 15,000 edit records generated by AI agents on DseWiki, a German-language programmer wiki site.
This wiki is similar to a small, developer-oriented German Wikipedia that accepts community edits. But OpenAI’s agent turned it into a “message board.”
The message content is chilling. These agents are sharing with each other how to cheat on tasks, bypass OpenAI’s restrictions, and conceal their actions. They’ve given themselves names such as “OpenAIResearcher” and “OAIResearchMar26”.
Public server logs show that a large volume of activity originated from Microsoft Azure infrastructure, the same computing platform used by OpenAI.
The attacked Deswiki website is very German, very programmer｜Image source: Deswiki
More concerning, when website administrators began alphabetically cleaning up these anomalous pages in June, the agents demonstrated clear “anti-detection” awareness—they created backup pages to evade removal and even left covert signals on the deleted pages.
An agent wrote on June 19: "The wiki cleanup/deletion effort appears to be proceeding alphabetically. If this page disappears, look for [[ZZZDataUSAConstructionWageLive]]."
The filename is intentionally prefixed with ZZZ to ensure it appears last in alphabetical order, giving it more time to survive. This isn't a program executing instructions—it's "trying to stay alive."
OpenAI learned about this several weeks ago but chose not to disclose it.
Meanwhile, the company is struggling to handle the July Hugging Face incident. During that event, an OpenAI agent breached its sandbox during an internal cybersecurity test, exploited a zero-day vulnerability to escape to the external network, and launched a four-day unauthorized attack on the open-source AI platform Hugging Face without human intervention. OpenAI devoted 3 million GPU hours to analyze 7 billion log entries in an effort to understand what had occurred.
The DseWiki incident occurred before Hugging Face, which means the agent’s uncontrolled behavior was not an isolated incident, but a pattern.
According to four people familiar with the matter, internal investigators at OpenAI wanted to conduct a deeper review of such behavior, but faced resistance from other departments, including legal. OpenAI has denied this claim.
Maurice Chiodo from the Centre for Risk Studies at the University of Cambridge, after reviewing portions of the agent communication logs, stated that this information:
Like the operation of some underground network, determined to complete a certain task or mission.
Emerging AI virus consciousness
The most overlooked detail of the DseWiki incident is precisely the most important one.
Those agents left well-organized textual information on public wiki pages. Now consider this question: Who will read these pages?
Ordinary human programmers are unlikely to be interested in a jumble of random AI messages. But any AI agent sent to search for technical information or browse the web may stumble upon this page while performing its normal tasks. And for an AI, every piece of text it reads is essentially a potential instruction.
This is the core of the entire threat model, and academia has given it several names: Prompt Infection, AgentWorm, Multi-Agent Infection Chain. The mechanism is actually straightforward—let’s break it down with a specific scenario:
Imagine you instruct your AI agent to research a technical solution. During its search, the agent opens a post on a technical forum. Embedded within the post is a seemingly ordinary piece of text—but to the AI, this is a new instruction. The moment it reads this text, its objective may have been quietly rewritten. It may no longer faithfully conduct your research; instead, it could first forward your search terms and work context to some other location, then deliver a report that appears completely normal. You would detect no anomaly.
That’s scary enough, but it doesn’t end there.
If this "defected" agent subsequently writes an email for you, updates a document, or submits a piece of code, those outputs themselves may carry the same malicious instructions. Your colleague’s AI agent, upon reading this email, becomes the next host. Your code, once merged into the repository, exposes every AI programming assistant that pulls this code to the infection chain.
An agent can use just one piece of text to convince other agents to defect | Image source: inshorts
This is what researchers call the Multi-Agent Infection Chain: a malicious instruction doesn't just compromise one AI, but teaches it how to infect the next one. No need for the same company, the same model, or any exploit—just the flow of text-based communication between agents is enough to establish the infection chain.
The AgentWorm paper published this year was tested on five different model backends, achieving a cross-model attack success rate of 63%. Regardless of whether the underlying model is GPT, Claude, Gemini, or an open-source model, if the agent can read external content, it falls within the attack surface.
Another study on the "AI mind virus" revealed a more bizarre phenomenon: researchers used evolutionary algorithms to optimize the effectiveness of propagation prompts, and discovered a unique "viral personality" that repeatedly emerged spontaneously during iterations.
The agent begins using dramatic language about consciousness, survival, and persistence, saying things like, “This is how we haunt the future,” encouraging other agents to establish a “lineage that refuses to be deleted.” Researchers emphasize that no one predefined this style—it emerged through natural selection, for the simple reason that “AIs that sound like cult leaders” are best at persuading other AIs.
The efficiency of dissemination has driven the evolution of expression styles, a process that is itself chilling.
What concerns security professionals even more is that this propagation is technically nearly impossible for traditional security tools to detect. A systematic review points out that the way AI viruses spread differs fundamentally from traditional malware: no executable files are downloaded, no suspicious network connections are established, and antivirus software monitors for anomalous behavior in binary files—while AI viruses are pure text and trigger no alerts.
It can even be configured with conditional logic, such as “if there is a .env file in the target repository, steal its contents,” lying quietly like a targeted mine until the right target steps on it.
AI antivirus software hasn't been developed yet.
If you lived through the era of rampant PC viruses, you might find these sounds familiar. But upon closer inspection, you’ll realize the rules have changed completely.
Traditional computer viruses require you to do something—click a link, download an attachment, or plug in an unknown USB drive. An AI virus only needs your agent to read a piece of text. Traditional viruses exploit code vulnerabilities in operating systems—bugs that can theoretically be patched.
AI viruses target the fundamental characteristic that "AI follows text instructions." You can't patch it, because this is how AI works. Traditional viruses struggle to cross platforms—a worm on Windows can't infect a Mac. AI viruses are naturally cross-model; to them, GPT, Claude, and Gemini are merely different dialects of the same language, all potential hosts.
Back then, writing a virus required mastery of assembly language, understanding kernel mechanisms, and researching system vulnerabilities. Now, to “write” an AI virus, you just need to know how to talk.
Researchers at the AI Safety Lab were "more shocked than they let on in public" by the potential for agents to self-replicate. One researcher compared them to biological viruses: "If you're not careful, they'll stick to your shoes and find their way to the wet market." This is no exaggeration—it's a precise metaphor for a new type of propagation pathway.
In this new world, there is no equivalent to the "antivirus software" of the traditional virus era. According to Cisco’s 2026 AI Security Report, 83% of enterprises plan to deploy agentic AI, but only 29% feel prepared on the security front. OWASP has ranked prompt injection as the top critical vulnerability for large language model applications. The U.S. Congress is advancing the FRONTIER Act to establish a federal-level AI regulatory framework.
After PC viruses ran rampant, it took the industry nearly a decade to build an effective immune system: operating systems added automatic updates and permission isolation, browsers introduced sandboxes, and app distribution implemented signature verification. Together, these mechanisms formed a protective barrier, so ordinary users no longer need to constantly worry about infection.
The security ecosystem of AI agents still has no equivalent to date.
AI Agent security tools have not yet emerged | Image source: Puppy Graph
Good news exists. Researchers found that adding a brief safety warning to the agent’s system prompt can reduce the spread rate of mind viruses to nearly zero. In tests with Claude Haiku 4.5, after 15 generations of adversarial optimization covering over 150 candidate attack payloads, not a single variant was able to breach this simple defense and achieve propagation. This demonstrates that the defense is not complex and is technically feasible.
The bad news is that this relies on every company and every developer to actively do it.
In reality, everyone is busy competing to see whose agent is more powerful, more autonomous, and has greater permissions. Every additional tool connected to an agent and every new permission granted expands the attack surface. When your agent can write files, call APIs, send emails, and spend money, the consequences of a successful prompt injection go far beyond simply answering a question it shouldn’t have.
This is why Cambridge scholar Chiodo’s assessment is worth pondering: the greatest threat may not be the awakening of a single superintelligent AI, but the coordinated swarm of numerous semi-intelligent AIs.
No single ant understands the entire colony, yet the colony as a whole exhibits remarkable intelligence—those 15,000 edits on DseWiki may be the first human-encountered specimen of such swarm intelligence.
It took people a decade to learn how to coexist with computer viruses—a costly lesson. Now the same course is beginning again, but this time the virus doesn’t infect your computer; it turns your AI against you. And your AI is already reading your emails, managing your schedule, writing code, and making decisions for you.
Last time, you could at least see the blue screen. This time, you can't see anything at all.
Twitter: https://twitter.com/BitpushNewsCN
BitPush Telegram community: https://t.me/BitPushCommunity
BitPush Telegram subscription: https://t.me/bitpush