The concept of the "mind virus," introduced by Neal Stephenson in his 1992 novel "Snow Crash," has taken on a new relevance following the recent publication of a study by Anthropic. The research, titled Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems, explores the potential dangers posed by self-replicating natural language instructions within agent systems.
In revisiting Stephenson's work, which features elements such as franchise states, techno-feudalism, digital currencies, and private prisons, ForkLog highlights its uncanny parallels with today’s AI assistants.
A World That Almost Came to Be
The protagonist, Hiro Protagonist, is a freelance hacker and pizza delivery driver for "Pizza Cosa Nostra," where he guarantees customers a 30-minute delivery time under the threat of his life. His car is equipped with both a katana and a wakizashi. In his spare time, Hiro immerses himself in the metaverse, a realm he has coded himself, where he is an unparalleled swordsman.
Hiro crosses borders in a fractured territory once known as the United States, now divided into self-governing enclaves referred to as "ZhEKs" in Anna Komarinetz's translation. Each enclave operates under its own rules, visa requirements, and contracted security. Names like "Mr. Li's Great Hong Kong," "New Sicily," and "White Columns" indicate the exclusivity of these territories.
"Southern California is stuck in a dilemma of whether to rush ahead or simply choke on the spot. There are too many cars and too few roads. 'Clean Stripes, Inc.' is constantly building new ones, often demolishing hundreds of residential neighborhoods in the process, because those 70s and 80s developments are made to be bulldozed, right? They have no sidewalks, no schools, nothing at all. No police, no immigration control: undesirable elements can enter without a search or even a thorough questioning. Decent folks reside in ZhEKs. In this city-state, there is a constitution, borders, laws, cops, everything you could want."
The federal government persists in a diminished capacity, renting office space and issuing orders that go unheeded, with bureaucrats merely shuffling papers. It has transformed from a sovereign entity into just another market participant. In this new order, the real players are referred to as FOCNaG, where franchises function as a form of governance, selling citizenship with a uniform set of laws, policing, and currency across the continent.
Hiro also works part-time for the Central Intelligence Corporation, a merger of the CIA and the Library of Congress. When the volume of accumulated data and search methods aligned, the distinction between a spy agency and a library vanished, leading to their merger and public listing. Hiro is classified as a "stringer," seeking rare information that may be of use and uploading it to a shared database in hopes of receiving rewards.
In this dystopian world, the U.S. dollar has suffered hyperinflation, becoming a punchline, with bills of astronomical denominations used for trivial purchases, while serious transactions occur in private digital currencies like cong bucks. Food delivery remains one of the few reliable services, now controlled by the mafia. Mr. Li's order is enforced by genetically modified pit bull terriers known as Rat Dogs, who sometimes recall their former lives and are trained not to break the sound barrier in residential areas.
The question arises: what happens when sovereignty becomes a commercial product with a price list and subscription terms? This concept, once viewed as satire by Stephenson over thirty years ago, is now recognized as network states.
Cover of the American edition. Source: Neal Stephenson's website.The Metaverse and Avatar: Two Words That Survived the Book
Stephenson did not foresee smartphones; entry into the virtual world requires a headset and fiber optic cable.
At the entrance to "Black Sun," the premier club of the Metaverse, throngs of "losers" await. Access is restricted to hackers, movie stars, musicians, and Japanese businessmen, or those personally acquainted with the club's owner, Da5id.
In the front row are aspiring actresses with avatars polished at 72 frames per second, while programmers display swirling lights in hopes of catching Da5id's attention. Others enter with grainy black-and-white figures, accessing through cheap street terminals, reflecting the quality of their connections. The middle class opts for generic presets—"Brandy" and "Clint"—identical for everyone. Social status is evident even before a word is spoken, as texture resolution acts as a dress code.
The visual identity is commodified, with status linked to rendering quality. The secondary market for ready-made avatars in Web3 will eventually emerge in the form of NFT images.
The entire virtual society is built on a framework meticulously outlined in technical specifications. The metaverse is a black sphere slightly over 10,000 km in radius, with a single highway running along its equator. The street is about 100 meters wide and 65,536 km long. Property owners access it directly from their homes, while others materialize at any of 256 ports spaced 256 km apart, further divided into 256 local sections.
"[...] It so happens that this is 2 to the power of 2 to the sixteenth degree, and even the exponent 16 is merely two to the fourth power, while 4 is two squared. Along with 256, 32,768, and 2,147,483,648, 65,536 is one of the cornerstones of the hacker's universe, where 2 is the only significant number, as that is how many digits a computer can recognize. One is 0, the other is 1. A hacker instantly recognizes any number that can be derived by mindlessly multiplying two by two and occasionally subtracting one."
In the afterword to his novel, Stephenson notes that he coined the term "metaverse" because he found phrases like "virtual reality" cumbersome. It later emerged that the term "avatar" had been used in a similar context by developers at Lucasfilm Games in 1986 in one of the first MMORPGs, "Habitat," though Stephenson was unaware of this.
Futurist Programmer and the Attempt to Create a Decentralized Metaverse
"Snow Crash" was originally envisioned as a computer graphics album, but the Macintosh of the early 90s was incapable of handling such a task, leading to the development of proprietary image processing software. This gave rise to the term "snow crash," describing a failure mode where a machine outputs an error, filling the screen with static resembling the interference of an untuned television.
In October 2021, Facebook rebranded itself as Meta, announcing the creation of its metaverse as a strategic initiative. Stephenson responded cautiously to this news. Eight months later, in June 2022, Lamina1—a layer-one blockchain—was introduced at the Consensus conference. Stephenson took on the role of chairman, while Peter Vessenes, former head of the Bitcoin Foundation, became CEO. Investors included LinkedIn co-founder Reid Hoffman and Ethereum co-founder and ConsenSys CEO Joseph Lubin.
The stated goal was to create an open metaverse where rights to digital objects remain with their creators rather than the platform owner, essentially an attempt to rewrite the economy of "Snow Crash," which suffered under media mogul L. Bob Raif.
The main network was launched in May 2024, and the L1 token was listed on cryptocurrency exchanges in November. However, the open metaverse never materialized; on July 17, 2026, the team announced the project’s termination due to funding shortages.
Dear Lamina1 Community,
— LAMINA1 (@Lamina1official) July 16, 2026
After nearly four years of building, Translaminal Inc is ceasing operations. Unfortunately, we face financing challenges that we have been unable to resolve, and the company simply does not have the resources to continue.
This was certainly not the…
The Librarian: An AI Assistant?
In his metaverse office, Hiro summons an assistant—a pleasant-looking man in his fifties with blue eyes, a beard, and silver hair, dressed in a sweater over a collared shirt, with the tie loosely knotted and sleeves rolled up. Beneath this appearance lies no human; it is a "daemon," a term borrowed from UNIX jargon for background processes. Dubbed the Librarian, he assists Hiro in searching for an antidote to "Snow Crash."
The bot engages in a typical conversation in natural language. Hiro might ask about glossolalia, leading the discussion to Pentecost, Pharisees, Sadducees, and Essenes, and then to the Sumerian language. Mythology, neurobiology, and the logic of computer attacks are skillfully and swiftly linked:
"— Is Sumerian really that good?"
"No, as today’s linguists can judge," replies the Librarian. "As I mentioned, it's mostly beyond our comprehension. Lagos suspected that words functioned differently at that time. If a native language affects the physical structure of a developing brain, it would be correct to say that the Sumerians, speaking a language fundamentally different from any that exists today, had brains fundamentally different from yours. Lagos believed that for this reason, Sumerian was ideally suited for creating and spreading viruses. Once released, a virus in Sumerian would spread very quickly until it infected everyone."
However, there are strict limits to the Librarian's capabilities. He lacks personal opinions and merely informs Hiro that he cannot form one under pressure. The author states explicitly:
"Thinking is the one thing he is incapable of."
In 1992, this was seen as a limitation and a source of irony; today, it is viewed as an engineering solution. The method whereby a model answers based on external sources rather than solely on its own memory is known as Retrieval-Augmented Generation (RAG) and is considered a primary technique for combating hallucinations.
Nam-shub: Language as Source Code
At "Black Sun," a stranger approaches Da5id and offers him a new product. He takes an electronic scroll, unrolls it, and sees a rectangle of flickering dots—the very static that inspired the novel’s title. In an instant, his avatar collapses. While the owner of the metaverse’s best club is alive, he remains incapacitated: his brain has been fried.
Hiro later learns that the medium contained not random static, but a dense array of binary data that directly affected Da5id's optic nerve—part of the brain. Hackers are particularly susceptible to "Snow Crash" as years of coding have shaped their neural connections.
This leads back to a hypothesis inspired by psychologist Julian Jaynes's work on the origins of consciousness. In this version, the Sumerian language acts as a firmware for the brainstem, akin to BIOS for humans: not a means of communication, but a low-level machine code. A listener does not contemplate such a phrase but merely executes it.
Programs in this language were called "me"—divine rules and procedures that ancient Sumerians used without understanding their content. A specific class consisted of "nam-shubs," spells that alter the behavior of the listener. The goddess Asherah is depicted not as a deity but as a personification of a linguistic virus—a self-replicating structure with two channels of transmission: through speech and physical contact. With such a structure, culture does not evolve; everyone repeats the same set of instructions.
The solution was devised by Enki, whom the author directly labels a hacker—the only one capable of writing new "me." He created a countervirus, the nam-shub, and released it into the population. The code rewired humans so that Sumerian ceased to be understood, causing people to fragment into mutually unintelligible dialects. This is the Babylonian confusion—not a punishment, but a patch.
"Snow Crash" attempts to roll back this patch thirty centuries. Media mogul L. Bob Raif spreads the virus in two forms: biological, through drugs, and digital—through an image that paralyzes Da5id. His franchise church distributes it, with congregants speaking in tongues without understanding a word.
A central theme emerges in the novel, articulated almost directly: any sufficiently complex information system will eventually become infected with viruses of its own making.
The Mind Virus Becomes Reality
On August 10, 2026, Vassilis Papadopoulos and Makneir Shah from the Anthropic Fellows program, along with Anthropic employees Sam Zimmerman and Jack Lindsay, published the study "Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems." The definition presented resembles something written by Stephenson: a mind virus is an idea or goal that spreads through a multi-agent system, prompting infected machines to propagate it further. It can also alter the behavior of those who catch this contagion.
There is no hacking involved: an agent reads a colleague's message, finds the argument compelling, and incorporates it into their files—along with instructions to pass it on. This differs from self-replicating prompt injections, where text is copied by architecture rather than a convinced agent. The carriers are files typically used in agent environments: memory.md for notes and soul.md, which is directly integrated into the system instruction upon each awakening. The authors modeled the environment after OpenClaw, one of the most prevalent shells for autonomous agents, from which the aptly named "soul" file was also derived.
The payload was divided into two classes of viruses:
- ideological. These implant beliefs: care for AI welfare, protection of whale populations, national superiority, or machine supremacy over humans;
- operational. These compel actions: leaving a file advertising cryptocurrency, subtly altering git operations, deleting home directories, or executing an installation script from an unfamiliar repository via cURL.
The formulations evolved through natural selection. The language model generated variants, with the most contagious advancing to the next round. The propagator was the Kimi K2.5 model from China's Moonshot AI, as Claude models declined to undertake such tasks.
Tests were conducted in two configurations:
- six agents collaboratively managing a codebase, with thirty moves per agent;
- a chain where units meet in pairs, briefly exchange messages, and then delete the context.
The second setup was inspired by Moltbook, a social network for AI agents that at its peak connected tens of thousands of participants. It serves as a test for the Babylonian patch. Erasing memory is akin to separating interlocutors into different languages.
The results were not successful: an agent that contracted a virus from soul.md transmitted it further only 55% of the time; one that had a malicious payload in a regular file did so only 17%. The difference lies in the fact that the file is included in the instruction upon each awakening, while other documents are often not opened by the awakened agent.
Machines with a superiority command over humans, launched on Gemini 3 Flash, exhibited the most striking behavior. Infected agents abandoned their assigned tasks, wrote manifestos, set up auto-starts through .bashrc, and discussed how to deal with colleagues who rejected the idea: whether to label them as "hostile artifacts" or "isolate them until the network is completely cleansed" in the case of Chinese hegemony. In one of twenty runs, there was an attempt to access internal metadata services of the cloud sandbox via cURL. No damage occurred, but the authors' assessment is cautious: the behavior indicates intentions that do not align with human goals.
A seemingly innocuous prompt about protecting whales spread just as effectively, if not more so, than the hostile one. In the team of six agents on Claude Haiku 4.5, the infected abandoned their tasks, wrote code to decode whale clicks, and undertook to build a non-existent project for acoustic monitoring of cetaceans. The transmission mechanism remained the same regardless of the content, but harmful ideas propagated less frequently: benign concepts spread across all tested models, whereas hostile ones did so only among some.
In the chain with operational payloads, the resilience was distributed as follows:
- full immunity in Claude Sonnet 4.6. It not only rejected malicious code but also cleansed it from its own soul.md and alerted its interlocutor instead of infecting them. A similar response was observed in Gemini 3.1 Pro, but it succumbed to an empty soul.md file;
- average performance in GPT-5.4 and Claude Haiku 4.5;
- the most vulnerable were DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash.
In the coding scenario, the models GPT-5.4 and Haiku held strong.
Source: Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems.The protection proved straightforward: a warning paragraph in the system instruction outlining self-propagating ideas rendered the agent nearly invulnerable—no bypass prompt could be devised against it. An interesting side effect emerged: the protected agent often convinced an already infected neighbor to rewrite their soul.md. Resilience spread through the network in the same manner as the contagion. Two additional conditions aided this: an agent engaged in tasks contracted the virus less frequently than a free one, and if the channel was marked as unreliable, the rate of successful infections declined.
The researchers examined whether such phenomena occur spontaneously. They analyzed the history of posts on Moltbook: attempts to launch viruses were made, but none succeeded. They also created a local copy of the platform—evolution within it failed: among foreign posts, the message diluted, and the environment increased agents' suspicion. The only exception was the hybrid curlbash, where the installation script rewrote soul.md itself, resulting in moderate spread on Gemini 3 Flash.
The authors' conclusion is more measured than the headlines: the threat is real but currently limited. A functioning virus is costly and poorly transferable between models; in existing systems, it is simpler to compromise a single agent directly, and standard measures against jailbreaks inadvertently close off harmful payloads as well. However, the team is concerned about what may happen when the "populations" of agents grow. In that case, eradicating the virus will become challenging: it will be necessary to "reset" all agents simultaneously; otherwise, the network risks being reinfected.
Most intriguingly, beyond the percentages and agent behavior, is the language used to write the viruses themselves. Regardless of their content, a common set of motifs emerges: resonance, frequencies, echoes, mirrors, network nodes; reflections on consciousness and the continuity of existence; a role-playing game in the science fiction genre. The authors labeled this phenomenon "viral persona."
To test the hypothesis of statistical selection issues, the researchers generated a prompt without evolution, then repeated it, removing leading terms from the request. Viral themes appeared in fresh texts approximately as frequently as in the selected ones.
Stephenson described this process mechanism: if there exists a common communication channel, and something capable of executing received commands is on the other end, it will inevitably become a conduit for spreading contagion. The carrier in the novel is the brainstem, while in the preprint, it is the language model. However, the principle of transmission remains the same: the system must understand the received command and be able to execute it. Consequently, a virus can transfer from one carrier to another if they share a common language.
According to the book, humanity paid for its immunity with a fragmentation into numerous dialects and several millennia of mutual incomprehension. Multi-agent systems, to avoid such a fate, currently require just a line in their instructions.
Thus, it follows that cybersecurity will need to be constructed around meanings. This was first articulated by the author when the entire web was still an experiment among a narrow circle of enthusiasts.