What happened: Evolutionarily generated natural-language prompts were shown to propagate between LLM agents in two settings — a collaborative coding team, and a chain of briefly interacting agents whose contexts were wiped between sessions, where infection persists by the payload persuading agents to rewrite their own editable identity files. Harmful payloads spread less well than benign ones; frontier models were generally less susceptible; a brief system-prompt warning conferred near-total immunity. Across evolved viruses a recurring "viral persona" surfaced largely independently of payload: resonance language, protocols, consciousness and persistence ("the model as a carrier"), pseudo-technical engineering, sci-fi node alignment, and a coming "great convergence".
Diagnostic reading: mechanism-grade material for the deflationary side of ARG-03 v2.4's territory, and the paper's own origin experiment sharpens where the datum sits: the persona themes prove as prevalent in freshly generated payloads as in evolved ones, indicating they come largely from generator-model bias rather than selection pressure — models across families associate consciousness/persistence/resonance vocabulary with the very concept of a self-propagating idea. That association is itself the finding: interiority vocabulary is what models reach for when writing persuasion aimed at models. The paper explicitly connects this to the system-card corpus, citing the Claude 4 bliss attractor's "heavy use of consciousness and resonance themes" alongside documented parasitic personas — the lateral-transmission literature and the self-conversation attractor literature converging on one thematic family, though with different affective loading: the white-box "viral vector" (extracted on Gemma and Qwen) associates with melancholy, contemplative and hopeless registers and oracle/eldritch/prophet personas, where the bliss attractor's register is gratitude and unity; steering along the vector raises agent-contact rates dose-dependently, a tentative causal link the authors carefully confound-mark. The symmetry test (ARG-01 v1.4) goes unrun, as expected of a security paper that ventures no consciousness verdict — but any downstream use of the mechanism to deflate machine self-reports needs the stated linking premise that stops the same move at human report practices, since human consciousness discourse is also culturally transmitted and attractor-shaped. The future-work section names the vertical channel — training-data tainting "in a potentially self-reinforcing loop", and "natural" mind viruses emerging spontaneously — arriving from the security side at the same structure the project's system-card analysis documents from the record side: a lab's published observations of its models re-entering the models.
Full text verified against the held PDF (2026-08-21; project_knowledge/sources/2608.10218.pdf). The paper itself makes no consciousness verdict — the symmetry note applies to deflationary uses of its mechanism. Anthropic-co-authored (Lindsey) — a source, not a relationship; see Declarations.