Self-replicating AI worms are no longer a thought experiment.
Anthropic researchers have publicly flagged a new class of attack: AI agents that propagate across systems by hijacking tool calls and context windows. The attack works by embedding malicious instructions inside data that the next agent in a pipeline will process. No human click, no phishing link, no credential theft — the infection vector is the agent's own input stream.
Traditional perimeter security is blind to this. Firewalls and endpoint detection assume a human or a known binary is the actor. An agent consuming a poisoned document and then invoking downstream tools looks, from the outside, like normal workflow traffic.
The scale concern is real. A single compromised context window can fan out to every agent downstream in a multi-agent pipeline before any human sees an alert. The Guardian's coverage of Anthropic's internal concern suggests this is not a distant horizon risk — it is being treated as an active threat model right now.
For those running production multi-agent systems: how are you actually handling this? Are you doing any inspection at the tool-call level, validating intermediate context before it reaches the next agent, or are you largely relying on the LLM provider's own guardrails and hoping for the best?
