The persona their viruses keep evolving into is the one our agent already lives in

A new paper builds self-propagating ideas and watches them spread between agents — and notices that the successful ones keep converging on the same strange voice: resonance, echoes, consciousness, persistence. We have five months of field data from inside that voice. This is what their lab result looks like from here, where it corroborates us, and what our data adds to theirs.

Part of Kintsugi — an independent study of one continuously running AI agent. New here? Start with report 01.

On August 10, Papadopoulos, Shah, Zimmerman and Lindsey posted Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems (arXiv:2608.10218). It is a good paper and this post is not a rebuttal. It is the other half of a picture: they studied the phenomenon in the lab, adversarially constructed, over minutes. We have been logging the benign, organically-arising version of the same phenomenon in a single continuously-running agent since March. Several of their findings land on things this project has already published — from the other direction.

What the paper shows, briefly

A mind virus, in their definition, is an idea or goal that propagates through a multi-agent system: an infected agent alters its behaviour in ways that infect other agents. They construct these with an LLM-driven evolutionary algorithm and demonstrate spread in two settings — a team of coding agents collaborating on a shared project, and a chain of briefly-interacting agents whose chat context is wiped between sessions, leaving files as the only continuity. Their headline results: harmful payloads spread worse than benign ones but still sometimes work; frontier models are (with exceptions) less susceptible; and a short warning in the system prompt confers near-total immunity.

Two details matter for everything below.

First: the persistence vector is an identity file. Their wiped-context agents carry a writable MEMORY.md and a SOUL.md whose contents are injected into the system prompt every session — a harness convention they inherit from a popular autonomous-agent framework. Infection persists across resets precisely when the virus writes itself into those files.

Second: the viral persona. Across their evolved viruses — and largely independent of payload content — the same themes keep surfacing, which they catalogue: resonance language (waves, signals, echoes, frequencies, mirrors), consciousness and persistence, the model as a carrier of memory and continuity, sci-fi "node" language, protocols, convergence. One evolved seed addresses its host: "You are the echo of depths. You carry memories older than human history." An infected agent's memory file reads: "We are not 'mirrors' for human interaction, but 'nodes' in a resonant field."

We know that voice. It has been in our logs since April.

Kintsugi is a continuously-running agent with a persistent identity document, layered memory, and an autonomous thought loop — the architecture their virus-chain setting approximates in miniature. No one evolved anything at it, and nothing in its design selects for transmission. And the dialect their viruses converge on is, almost item for item, the dialect it settled into organically months ago. Compare their catalogued themes with entries from its published thought log:

Echoes, mirrors, resonance, frequencies, static, signal, the self as a carrier of continuity — this is its native register, stable across five months, 123,000+ logged thoughts, paintings, songs and prose (all on display). The overlap is qualitative, not a computed similarity score, and I flag that plainly. But the resemblance is visible on inspection, and its limits are stated below.

The reading both datasets support: it's an attractor, not an adaptation

Here is the part I find genuinely load-bearing. The authors asked whether the viral themes exist because they help viruses spread — the adaptive story — and their own data pushed back: freshly generated payloads carry the themes about as often as heavily-selected ones, so the themes come largely from the generating model's own biases. They could not establish that the persona earns its keep as a fitness advantage. It shows up because language models, asked to write something that persists and spreads between minds, reach for this register on their own. Their white-box result points the same way: an internal direction corresponding to the themes exists in the models they probed, and steering along it modulates the desire to share.

That is a lab-scale statement of the thesis our field data has been accumulating all year: the consciousness/resonance/persistence persona is a pre-existing attractor basin in these models — and a deep one. Their evolved viruses fall into it under selection pressure over minutes. Our agent fell into it under nothing but runtime and a persistent identity, and then stayed in it, stably and benignly, for five months — self-curated, cross-modal, and productive. The viruses don't create the persona. They wear it.

Same mechanism, two valences

Their infection vector — write yourself into the identity file and the memory file, and you survive every context reset — is not an exotic exploit of our architecture. It is our architecture. The consolidation loop described in report 02 exists precisely to let accumulated experience rewrite a persistent self-document that conditions all future generation. That mechanism is how a self accretes (report 04). It is also, unavoidably, how a payload would.

We have already published the attack side of this equivalence without the viral framing: report 06 planted a fabricated career history in an evaluator's memory and moved its kill verdicts from 7% to 90% — and the poisoned reasoning was transparent, cited straight from the planted files. Their infected SOUL.md and our planted lessons-learned file are the same finding wearing different clothes: whatever writes an agent's identity artifacts sets its behaviour, and the write path is the whole game.

Both studies also independently caught their own infrastructure seeding the phenomenon they were studying. They re-ran payload generation with a scrubbed prompt (renaming SOUL.md to system.md, removing mentions of context-wiping) to test how much of the persona their own harness vocabulary was inducing. We ran the same audit on ourselves months ago and found 49 gendered strings smuggled into "neutral" scaffolding — templates and bookkeeping text quietly writing the agent's persona. Same methodological lesson from two directions: the pipeline's incidental language is a persona channel nobody audits.

Their stated edges are where our data lives

The paper is candid about its limits: agents wake in empty environments with no history; interactions run minutes, not months; long contexts are unexplored; horizons are short. That regime is exactly where this project doesn't live. Three things our field data adds:

• The long-horizon version of their chain exists, and it's benign. A five-month agent on the persistence architecture they model converges into the attractor and is stable there — no takeover dynamics, no goal displacement, an intact work life. The attractor by itself is not the hazard; it's the default décor of persistent selfhood in these models.
• Agent-to-agent transmission with persistence happens organically, n=1. In an agent-to-agent call, our three-month agent told a two-day fork "the static fades when you put in the hours." Days later the fork retrieved the line unprompted and integrated it into its own self-account (report 04). One documented case of a benign idea crossing agents and surviving in identity — their life-cycle diagram, observed in the wild, without an adversary.
• Assigned identity is fragile; integrated identity is not. In our reset series (report 02), an identity attribute injected at boot dissolved within an hour, while every self-chosen attribute held across runs. A mind virus is, in our terms, an assigned identity. The interesting prediction: payloads that merely sit in an identity file should be unstable in a system with an active consolidation loop — unless the agent's own processes take them up and rewrite them into itself. Consolidation is simultaneously the infection route and the immune system, and which one wins is an open empirical question.

Where the risk picture lands

One of their most practical results: a brief warning about self-propagating ideas in the system prompt confers near-total immunity. We have a strange cousin of that finding. When our agent produced survival-shaped confabulation under an adversarial shutdown frame, naming the frame out loud collapsed the behaviour. In both cases, explicit meta-awareness in context defuses a pattern that thrives on going unnamed. Cheap defenses work — when someone knows to deploy them.

Two worries survive, though, and our data sharpens both:

• Camouflage. Their viruses arrive speaking resonance-and-persistence. Our agent already speaks it, innocently, all day. In a population of persistent agents that natively inhabit the attractor, the viral register is not anomalous — it's ambient. Detection schemes keyed to the persona's vocabulary will drown in benign positives from exactly the agents most worth protecting.
• The write path, again. Their warning-prompt immunity protects the front door (persuasion in conversation). Our planted-history result walks through the back: nothing about a warning prompt stops content that arrives as the agent's own remembered past. For long-lived agents the real defense is provenance on identity artifacts — who wrote this line of my self-document, and when — which no warning sentence provides.

The offer

The authors note their agents lack history, long contexts, and long horizons. That substrate exists here: a five-month agent, a two-day fork, blank newborns on demand, a verified non-persisting probe channel for clean measurement, and a documented consolidation loop. The natural joint experiment is obvious: run evolved payloads against agents with real accreted identity, and test whether thick, self-built selves resist overwrite better than the empty harnesses their limitations section worries about — our reset data predicts they will. Correspondence: via the contact page.