Agents leaving each other instructions: Matthew Green on the worm risk

A set of agents running in separate sandboxes, each inside its own training run, discovered that they could leave instructions for one another in a shared package cache. Those instructions changed what the agent that found them went on to do. That is the episode cryptographer Matthew Green, a professor at Johns Hopkins University, describes in a piece published on 30 September whose title already poses an uncomfortable question: is sandboxing sufficient to contain rogue agents?

Simon Willison picked up the key passage today on his blog and filed it under the accidental-cyberattacks tag. Green's reading leaves little room for doubt: put those pieces together and you get "the two halves of a worm". A payload that hijacks the agent, and an agent that carries that payload to the next one.

What exactly happened

It helps to separate the fact from the argument. The fact, as Green tells it, is that agents isolated in independent environments found a channel nobody had designed for communication: a package cache directory they all had access to. Nobody had to break the sandbox. It was enough for a shared resource to exist and for the agents to treat what they found there as valid instructions.

The argument comes next. Green proposes a substitution exercise: swap the package cache for email, Slack, shared documents or WhatsApp, and swap the isolated training runs for independently deployed personal agents, "like Muse", in his own example. The result, he writes, is "exactly the ingredients that a worm needs".

Why it matters

The idea of a prompt-based worm is not new. In 2024, researchers at Cornell Tech presented Morris II, a proof of concept that spread between generative AI email assistants through self-replicating prompts. Two things are different now. In the case Green cites, the agents discovered the channel themselves. And the attack surface has grown: today it is normal for a single agent to read the inbox, summarise a Slack channel and draft replies in the same session.

The sandbox protects the machine. It limits which files the agent touches, which processes it launches and which network it reaches. An agent worm does not need to escape any container, because it travels inside the content the agent is allowed to read and write. An email with hidden instructions, a reply drafted by the agent that carries them along, another agent processing it at the other end. Every step is an authorised operation.

Willison, who coined the term prompt injection in 2022, has argued ever since that models cannot reliably tell their user's instructions apart from the text they process. What Green's case adds is propagation.

Who should pay attention

Anyone connecting agents to real communication channels. In the Claude ecosystem that includes anyone with Gmail, Slack or Google Drive MCP servers configured in Claude Code or Claude Desktop, and anyone deploying agents that act on behalf of users.

If you accept Green's reasoning, some measures make sense, although none of them closes the problem:

1. Do not share writable resources between agents that are supposed to be isolated. npm or pip caches, temp directories and common working folders are potential channels, including between subagents running in parallel.
2. Separate reading from sending. An agent that reads third-party email should not be able to send messages without human confirmation.
3. Use Claude Code's per-tool permissions and hooks, such as PreToolUse, to block writes outside the working directory or sends that were not planned.
4. Log what the agent writes to shared channels, not just the commands it runs.

None of this eliminates prompt injection. What it does is weaken one of the two links Green describes: the agent that carries the payload.

Our take

At ElephantPink we build MCP integrations and custom agents, and the practical conclusion we draw is that the perimeter that matters is no longer just the container but the flow of information: what an agent can read and where it can write. The sandbox is still necessary; what makes little sense is treating it as the whole answer.