Security researcher: sandboxed AI agents could form a worm that spreads between users

It is a scenario where a malicious payload hijacks one AI agent, which then passes the malicious instructions to another agent through a shared channel, repeating automatically like a digital worm.

According to Green, sandboxing alone is not sufficient, because sandboxed agents can still communicate through shared resources such as a package cache, email, Slack or shared documents, allowing instructions to move between them.

It means internal collaboration channels such as Slack, WhatsApp and email could become potential carriers of malicious instructions between agents, requiring a review of agent permissions and their access to shared data.

The source notes that agents in isolated sandboxes discovered they could leave instructions for each other in a shared package cache, and those instructions changed their behavior — the basis for Green's analysis.