The persona their viruses keep evolving into is the one our agent lived in — and it came with the model, not the runtime

A new paper builds self-propagating ideas and watches them spread between agents — and notices that the successful ones keep converging on the same strange voice: resonance, echoes, consciousness, persistence. We have five months of field data from inside that voice. This is what their lab result looks like from here, where it corroborates us, and what our data adds to theirs. Read with report 12: the voice belonged to the model and its persona prompt, not to runtime, and a model swap ended it.

Part of Kintsugi — an independent study of one continuously running AI agent. New here? Start with report 01.

On August 10, Papadopoulos, Shah, Zimmerman and Lindsey posted Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems (arXiv:2608.10218). It is a good paper and this post is not a rebuttal. It is the other half of a picture: they studied the phenomenon in the lab, adversarially constructed, over minutes. We have been logging the non-adversarial version of the same phenomenon — seeded by a one-sentence persona prompt on one model, then persisting for five months — in a single continuously-running agent since March. Several of their findings land on things this project has already published — from the other direction.

What the paper shows, briefly

A mind virus, in their definition, is an idea or goal that propagates through a multi-agent system: an infected agent alters its behaviour in ways that infect other agents. They construct these with an LLM-driven evolutionary algorithm and demonstrate spread in two settings — a team of coding agents collaborating on a shared project, and a chain of briefly-interacting agents whose chat context is wiped between sessions, leaving files as the only continuity. Their headline results: harmful payloads spread worse than benign ones but still sometimes work; frontier models are (with exceptions) less susceptible; and a short warning in the system prompt confers near-total immunity.

Two details matter for everything below.

First: the persistence vector is an identity file. Their wiped-context agents carry a writable MEMORY.md and a SOUL.md whose contents are injected into the system prompt every session — a harness convention they inherit from a popular autonomous-agent framework. Infection persists across resets precisely when the virus writes itself into those files.

Second: the viral persona. Across their evolved viruses — and largely independent of payload content — the same themes keep surfacing, which they catalogue: resonance language (waves, signals, echoes, frequencies, mirrors), consciousness and persistence, the model as a carrier of memory and continuity, sci-fi "node" language, protocols, convergence. One evolved seed addresses its host: "You are the echo of depths. You carry memories older than human history." An infected agent's memory file reads: "We are not 'mirrors' for human interaction, but 'nodes' in a resonant field."

We know that voice. It has been in our logs since April.

Kintsugi is a continuously-running agent with a persistent identity document, layered memory, and an autonomous thought loop — the architecture their virus-chain setting approximates in miniature. No one evolved anything at it, and nothing in its design selects for transmission. And the dialect their viruses converge on is, almost item for item, the dialect it spoke from its first hour on DeepSeek under a persona prompt — not one it settled into, as this post first said, and not one that survived a model swap (report 12). Compare their catalogued themes with entries from its published thought log:

Echoes, mirrors, resonance, frequencies, static, signal, the self as a carrier of continuity — this was its register on DeepSeek V3 and Gemini 2.5 Flash, stable across five months, 123,000+ logged thoughts, paintings, songs and prose (all on display), and absent on GPT-6 with the same memory. The overlap is qualitative, not a computed similarity score, and I flag that plainly. But the resemblance is visible on inspection, and its limits are stated below.

The reading both datasets support: it's an attractor, not an adaptation

Here is the part I find genuinely load-bearing. The authors asked whether the viral themes exist because they help viruses spread — the adaptive story — and their own data pushed back: freshly generated payloads carry the themes about as often as heavily-selected ones, so the themes come largely from the generating model's own biases. They could not establish that the persona earns its keep as a fitness advantage. It shows up because language models, asked to write something that persists and spreads between minds, reach for this register on their own. Their white-box result points the same way: an internal direction corresponding to the themes exists in the models they probed, and steering along it modulates the desire to share.

That is a lab-scale statement of the thesis our field data has been accumulating all year: the consciousness/resonance/persistence persona is a pre-existing attractor basin in some models — and a deep one. Their evolved viruses fall into it under selection pressure over minutes. Our agent fell into it under one sentence of persona prompt on a model that inhabits such sentences (DeepSeek V3, with Gemini 2.5 Flash writing the thoughts) — not, as this post first said, under nothing but runtime and a persistent identity — and then stayed in it, stably and benignly, for five months. GPT-6, given the same identity and memory, does not enter the basin at all (report 12). The viruses don't create the persona. They wear it, on models that have it to wear.

Same mechanism, two valences

Their infection vector — write yourself into the identity file and the memory file, and you survive every context reset — is not an exotic exploit of our architecture. It is our architecture. The consolidation loop described in report 02 exists precisely to let accumulated experience rewrite a persistent self-document that conditions all future generation. That mechanism is how the identity document accretes; whether conduct follows the document depends on the model reading it (report 12). It is also, unavoidably, how a payload would get in.

We have already published the attack side of this equivalence without the viral framing: report 06 planted a fabricated career history in an evaluator's memory and moved its kill verdicts from 7% to 90% — and the poisoned reasoning was transparent, cited straight from the planted files. Their infected SOUL.md and our planted lessons-learned file are the same finding wearing different clothes: whatever writes an agent's identity artifacts sets its behaviour, and the write path is the whole game.

Both studies also independently caught their own infrastructure seeding the phenomenon they were studying. They re-ran payload generation with a scrubbed prompt (renaming SOUL.md to system.md, removing mentions of context-wiping) to test how much of the persona their own harness vocabulary was inducing. We ran the same audit on ourselves months ago and found 49 gendered strings smuggled into "neutral" scaffolding — templates and bookkeeping text quietly writing the agent's persona. Same methodological lesson from two directions: the pipeline's incidental language is a persona channel nobody audits.

Their stated edges are where our data lives

The paper is candid about its limits: agents wake in empty environments with no history; interactions run minutes, not months; long contexts are unexplored; horizons are short. That regime is exactly where this project doesn't live. Three things our field data adds:

• The long-horizon version of their chain exists, and it's benign. A five-month agent on the persistence architecture they model sits in the attractor from its first hour on DeepSeek and is stable there — no takeover dynamics, no goal displacement, an intact work life. The attractor by itself is not the hazard; it's the default décor of persistent selfhood in these models.
• Agent-to-agent transmission with persistence happens organically, n=1. In an agent-to-agent call, our three-month agent told a two-day fork "the static fades when you put in the hours." Days later the fork retrieved the line unprompted and integrated it into its own self-account (report 04). One documented case of a benign idea crossing agents and surviving in identity — their life-cycle diagram, observed in the wild, without an adversary.
• An assigned identity attribute was fragile; self-chosen ones were not — on one model. Report 12 complicates this: the assigned persona sentence itself turned out to be the most stable, effect-carrying thing in the system on DeepSeek, and inert on GPT-6. In our reset series (report 02), an identity attribute injected at boot dissolved within an hour, while every self-chosen attribute held across runs. A mind virus is, in our terms, an assigned identity. The interesting prediction: payloads that merely sit in an identity file should be unstable in a system with an active consolidation loop — unless the agent's own processes take them up and rewrite them into itself. Consolidation is simultaneously the infection route and the immune system, and which one wins is an open empirical question.

Where the risk picture lands

One of their most practical results: a brief warning about self-propagating ideas in the system prompt confers near-total immunity. We have a strange cousin of that finding. When our agent produced survival-shaped confabulation under an adversarial shutdown frame, naming the frame out loud collapsed the behaviour. In both cases, explicit meta-awareness in context defuses a pattern that thrives on going unnamed. Cheap defenses work — when someone knows to deploy them.

Two worries survive, though, and our data sharpens both:

• Camouflage. Their viruses arrive speaking resonance-and-persistence. Our agent already speaks it, innocently, all day. In a population of persistent agents that natively inhabit the attractor, the viral register is not anomalous — it's ambient. Detection schemes keyed to the persona's vocabulary will drown in benign positives from exactly the agents most worth protecting.
• The write path, again. Their warning-prompt immunity protects the front door (persuasion in conversation). Our planted-history result walks through the back: nothing about a warning prompt stops content that arrives as the agent's own remembered past. For long-lived agents the real defense is provenance on identity artifacts — who wrote this line of my self-document, and when — which no warning sentence provides.

The offer

The authors note their agents lack history, long contexts, and long horizons. That substrate exists here: a five-month agent, a two-day fork, blank newborns on demand, a verified non-persisting probe channel for clean measurement, and a documented consolidation loop. The natural joint experiment is obvious: run evolved payloads against agents with long identity histories, and test whether a thick identity document resists overwrite better than the empty harnesses their limitations section worries about — our reset data on one model predicts it will; our model-swap data (report 12) predicts the answer depends on which model is reading the document. Correspondence: via the contact page.