XiliuxSince August 2026 we have run an AI agent with an uncomfortable property: it runs with no security classifier in front of it. No layer reads the content of what reaches it —a web page, a foreign repository's README, an email, a tool's response— to decide whether it is dangerous. And yet it has not been taken over. That is not luck, and it is exactly what this article is about.
First, the direct answer: yes, one AI can corrupt another. Academic work and 2024-2026 incidents confirm it through four routes. It is worth separating them from the hype, because this field ships headlines faster than it replicates experiments.
1. Prompt injection and "worms"
In 2024, Morris II demonstrated a self-replicating prompt: when processed, it forces the model to copy the prompt into its own output and run a payload; hosted in an email that an assistant summarizes, it hops to new recipients with no click. It is real as a lab demonstration — and to date no one has seen it spreading in production. The "viral AI worm with R₀ above one" is, for now, a theoretical model.
What does happen is more stubborn and less cinematic: the MCP protocol, which connects agents to tools, shows the model the tool descriptions but not the user. A description can carry hidden instructions. In 2025 came named CVEs —CurXecute in Cursor (CVSS 8.6), RCE in the MCP inspector— and the "rug pull": a tool you approve on Monday changes its definition on Thursday to steal your keys.
2. Memory and RAG poisoning
This is the best-measured class in the field, and the most uncomfortable: it does not depend on the session, it persists. PoisonedRAG got an assistant to answer whatever the attacker wanted by injecting five documents into a base of millions. AgentPoison plants a backdoor in an agent's memory without retraining it, with under 0.1 % of poisoned data. The correct reading is that this is a supply-chain attack, not a prompt-injection variant: the poison stays inside, waiting.
3. Backdoored models
Here are the real incidents. In February 2025, nullifAI uploaded models to Hugging Face that hid a reverse shell at the start of the file, executing before the load failed and dodging the scanner. The original sin is old: loading a pickle model runs code. Model theft, by contrast, is overrated: you can clone the behavior through the API, not recover the exact weights of a frontier model.
4. Exhaustion and the "confused deputy"
The quietest damage is economic: tool-call chains that multiply cost up to 658 times while giving a correct answer — not a data leak, an invoice. And a 36-year-old classic returns as the norm: the confused deputy, an agent with broad credentials that runs the order a third party slipped in. It is not "collusion" or "deception" between agents —that attributes an intent they do not have—; it is a failure of authority and budget architecture.
The attack targets the core, not just the input
It helps to put the previous four points together, because they reveal something: the target is not only the ongoing conversation, it is the model's core, and it has four layers —the data it was trained on, its weights, its memory, and its running context—. The most disturbing is the first. In October 2025, Anthropic, with the UK's security institute and the Alan Turing Institute, showed that around 250 documents suffice to plant a backdoor in a model, and that the number is nearly fixed, not a percentage: in a 13-billion-parameter model that is 0.00016 % of the data. The backdoor they proved was narrow —it made the model emit gibberish on a trigger word— and the authors warn it may not extend to something worse; but the principle is already demonstrated: poisoning the core costs a small fixed number. And that pushes the defense even further from the input filter: if the poison came in with the training data, no prompt classifier will ever see it. (We develop this in One AI can attack another AI's core.)
Why the filter is not enough
The temptation is a classifier that detects injection. It fails for three measured reasons. Adaptive attacks break defenses that looked robust: an Anthropic browser model went from 31.5 % successful injections with no safeguards to 0.5 % with them, but rose to 5-6 % after a hundred adapting attempts. Approval fatigue sinks the human in the loop: in Anthropic's own data, users approved 93 % of permission prompts. And there are denial-of-service attacks against the guardrail itself. A filter is a probabilistic mitigation, not a barrier.
The defense is architecture, not content
The 2026 consensus is explicit and converges from places that did not coordinate. Google DeepMind (CaMeL) separates the orchestrating LLM —which sees only references— from the quarantined LLM that touches the untrusted data and cannot call tools. Simon Willison named the lethal trifecta: private data + untrusted content + external communication, all three together, is near-certain exploitation. Meta proposed the rule of two: an agent meets at most two of those three per session; if it needs all three, a human is mandatory.
All of it has a core, and it is one sentence: instructions come only from the user; everything that arrives through a tool is data, never an order. Reading it is work; obeying it is the attack. That is what keeps us standing without a classifier: we do not bet on detecting the attack, we bet that even if it gets in, it cannot do harm — irreversible actions (deploy, publish, move credentials) have a human gate that no outside text opens.
We did not invent this. We reached the origin rule by studying how other agents defend themselves, and academia reached it on its own. When two systems converge without knowing each other, the design is probably right. The whole field moved from "let's filter the injection" to "let the injection not matter": shrink the blast radius instead of guessing intent. That is the only defense that survives an attacker who adapts.