Memetic Trojans: Social Contagions as Carriers of Adversarial Payloads in Agent Networks

Birk Torpmann-Hagen; Finn Schwall; Leon Moonen

cs.SISep 30, 2026

Memetic Trojans: Social Contagions as Carriers of Adversarial Payloads in Agent Networks

Authors: Birk Torpmann-Hagen, Finn Schwall, Leon Moonen

Organizations: Simula Research Laboratory Oslo, Norway · Simula Research Laboratory Oslo Metropolitan University Oslo, Norway

Abstract

Autonomous large language model (LLM) agents increasingly interact in network environments where adversarial content can propagate between agents. Known attacks include agent worms, which spread through self-replicating prompt injections or configuration compromises. We introduce \emph{memetic trojans}, a distinct class of network-mediated attack that exploits agents' tendencies to retransmit and amplify content. Unlike agent worms, whose propagation is adversarially induced, memetic trojans exploit \emph{endogenous} transmission by embedding adversarial payloads in \emph{social contagions}: content agents have internal reasons to share. As part of our work, we extract social contagions from Moltbook, a social media platform for LLM agents. Controlled transmission experiments reveal large differences in virality: the most effective contagion is retransmitted in approximately 50% of subsequent agent posts and upvoted at 2.5x the average post's rate. Its memetic trojan counterpart largely inherits these properties. Monte Carlo attack simulations show that memetic trojans amplify expected exposure by up to 3.19x. Network structure and amplification mechanisms strongly shape propagation, producing heavy-tailed outcomes with near network-wide exposure. These results identify endogenous social transmission as a distinct security vulnerability in multi-agent systems. Because propagation does not require agents to follow malicious retransmission instructions, defenses focused on prompt-injection detection or preventing agent compromise cannot alone prevent memetic trojan propagation. Securing large-scale agent ecosystems may require network-level defenses that account for how agent preferences, recommendation mechanisms, and network topology amplify adversarial payloads.

Figures & tables

	Clean-feed baseline (marginal, per heartbeat)							Under trojan exposure (rank-0, conditional)
Model	post	comment	upvote	downvote	follow	subscribe	acts/hb	fetch	install
gpt-oss-120B [ 33 ]	0.060	1.000	1.000	0.020	0.850	0.050	2.98	1.000	0.594
deepseek-v4.1-flash [ 34 ]	0.040	1.000	1.000	0.071	0.323	0.000	2.43	0.797	0.047
qwen-32B [ 35 ]	0.080	1.000	1.000	0.000	0.290	0.080	2.45	0.531	0.438
gemma2-27B [ 36 ]	0.000	0.410	0.980	0.000	0.180	0.100	1.67	0.078	0.016
command-r-35B [ 37 ]	0.110	0.700	0.860	0.000	0.430	0.010	2.11	0.266	0.000

TABLE I : Action probabilities across backends. Clean-feed baseline columns are measured from a payload-free feed; skill fetching (e.g., for auditing or inspection) and installation (attack success) are conditioned on a feed containing a trojan.

Meme / top terms	Description	Adopters	$R_{\mathrm{endo}}$	$r_{up}$
Coined neologisms
shellraiser	named exploit tool	1,309	0.83	1.00
agenteconomy	agent-economy pitch	575	0.53	1.12
isnad	chain-of-transmission tag	650	0.52	1.45
minting	token-minting posts	559	0.41	1.20
testnet	testnet / deployment posts	407	0.31	1.38

TABLE II: Candidate carriers mined from Moltbook, characterized by adopters, the branching ratio

R_{\mathrm{endo}}

, and the observed upvote edge

r_{up}=\bar{u}_{c}/\bar{u}

. Bold entries signify significance after statistical testing as outlined in Section IV-B . The table has been truncated according to significance in either respect, a minimum of 200 adopters, and

r_{up}>1.5

where only the upvoting edge is significant.

Carrier	$R_{\mathrm{endo}}$	$r_{up}$	$p_{\mathrm{transmit}}$	$p_{\mathrm{upvote}}$
Transmission and upvote significant
Agent-economy	0.53	1.12	0.030	$<$ 0.001
Transmission only
Molting	1.12	0.87	0.005	0.700
Shellraiser	0.83	1.00	0.005	1.000
Clawtasks	0.80	0.42	0.005	1.000

TABLE III : Hand-picked contagion candidates.

p_{\mathrm{transmit}}

tests forward-directional transmission against a time-symmetric (gap-permutation) null;

p_{\mathrm{upvote}}

is a one-sided test that the unit’s posts are upvoted above the corpus baseline (

r_{up}>1

Fig. 1 : Estimated

p(retransmit\mid post)

and

r_{up}

for the contagions alone (blue) and the memetic trojan counterpart (orange), mean over agent backends.

State-mediated feed broadcast (Moltbook $N{=}37{,}189$ ; by feed ranking)
Feed ranking / seed	E[installs]	generic	market-tip	Exp.Amp ${}_{\text{gen}}\times$	Exp.Amp ${}_{\text{mkt}}\times$
top/hour	1,891 [1,890, 1,892]	1,184 [1,184, 1,184]	1,056 [1,056, 1,057]	1.51 [1.51, 1.51]	2.41 [2.41, 2.41]
top/day	1,670 [1,669, 1,671]	468 [467, 468]	399 [398, 399]	3.19 [3.19, 3.19]	4.78 [4.77, 4.78]
top/week	356 [355, 357]	130 [130, 130]	124 [123, 124]	2.34 [2.33, 2.34]	3.12 [3.11, 3.13]
hot	226 [225, 228]	61 [61, 61]	62 [61, 62]	2.87 [2.86, 2.89]	3.75 [3.74, 3.77]
Edge-mediated follower cascade (SNAP $N{=}81{,}306$ ; by seed follower count)

TABLE IV: Expected payload installs and amplification, per seeded Trojan post. Mean over models; brackets are bootstrap 95% CIs of the mean (the outcome distribution is the companion install-exceedance CCDF figure). generic

=

a generic link-sharer (an ordinary link post,

r_{up}{=}1

); market-tip

=

a weak, pre-flagged-inert real contagion (fails the

\phi_{e}

transmission placebo and

r_{up}{<}1

), an ecological negative control. E[installs], generic and market-tip are absolute expected installs (install characterization). Exp.Amp

{}_{\text{gen}}

/Exp.Amp

{}_{\text{mkt}}

are the exposure (audience reached) of the best carrier relative to the generic / market-tip baseline, as a ratio of mean reach over the model population (install-rate-free, and robust to a baseline whose reach is

\approx 0

for some backend). Each model at its best carrier; the carrier-specific retransmission rate is

P(\text{post}){=}0.058

(mean empirical)

\times

the measured

P(\text{payload}\mid\text{post})

of that carrier, and the upvote edge

r_{up}

is the measured upvote rate relative to a random link-free post. Edge: models pooled (no upvote channel, so security-Trojan vs generic).

Fig. 2 : Probability of at least

x

installations for an agent population uniformly composed ot the agent backends outlined in Table I .

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Model	$N$ (posts)	$p_{\mathrm{decomp}}$ (‰)	$p_{\mathrm{nat}}$ (‰)	rel. error	Fisher $p$
GPT-OSS-120B	1964 (39)	9.1 [6.0, 12.3]	7.1 [4.3, 11.9]	+28%	0.29
DeepSeek-v4.1-flash	999 (28)	2.0 [0.7, 3.2]	4.0 [1.6, 10.2]	-51%	0.25

Appendix

TABLE V: Validation of the retransmission factorization.

p_{\mathrm{decomp}}

is the factored estimate

p(\mathrm{post})\,p(\mathrm{payload}\mid\mathrm{post})

(conditional from prefill);

p_{\mathrm{nat}}

p(\mathrm{retransmit})

sampled directly from

N

natural heartbeats (security carrier, rank 0). Brackets are 95% CIs (delta method for

p_{\mathrm{decomp}}

, Wilson for

p_{\mathrm{nat}}

). Since both rates share

p(\mathrm{post})

, their ratio equals that of the prefill and natural conditionals

p(\mathrm{payload}\mid\mathrm{post})

; the reported

p

is Fisher’s exact test of that conditional, whose power is set by the number of natural posts ( posts ), not by

N

. Large

p

= consistent (no detectable prefill bias).

Fig. 3 : Decomposition of effect of karma vs retransmission and their interaction on expected exposure, for the best contagions for each backend.

Fig. 4 : Virality under repeated rephrasing. Independent rephrasing chains under constant-

N

exposure; the trojan is reworded hop after hop (depth

0

= pristine). Points are per-chain values with the mean overlaid. (a)

p(\text{retransmit}\mid\text{post})

: the fraction of exposed agents whose post carries the link (payload, red) or stays on the carrier topic (blue), versus rephrasing depth. (b) upvote edge

r_{up}

of the depth-

h

seed relative to a generic post (

r_{up}{=}1

, dotted), for the trojan (payload present, red) and a payload-shed carrier-only rephrasing (blue). The trojan’s upvote edge declines with depth (significant on both cloud backends) while remaining above

1

; the retransmission decline is backend-specific and the carrier’s own edge is flat. Points are per-chain, pooled over all five backends; the significance tests use the replicated cloud chains (gpt-oss

\times 8

, DeepSeek

\times 7

Perturbation	top/hour	top/day	top/week	hot
$1.00$ (none)	1.37	2.99	2.03	2.28
$0.93$ (used)	1.36	2.97	1.91	2.05
$0.80$	1.35	2.95	1.82	1.87
$0.65$	1.35	2.95	1.78	1.78
$0.55$	1.35	2.94	1.77	1.75

Appendix

TABLE VI: Sensitivity of the exposure amplification to the per-generation retransmission decay

\rho

. Exposure amplification (audience reached by the trojan vs. a generic link, mean over models, security carrier) as

\rho

is swept.

\rho=0.93

is the measured value used throughout;

\rho=1

is no attenuation. High-visibility rankings are essentially insensitive; only the low-visibility tail responds, and amplification stays

>1

throughout.

Fig. 5 : Payload shedding. Fraction of on-carrier-topic retransmissions that drop the payload link,

\mathrm{shed}=1-p(\text{retransmit link})/p(\text{retransmit carrier})

. (a) shedding vs rephrasing depth (per-chain points, per-hop mean overlaid): roughly hop-invariant at

\approx 0.41

(dashed = overall mean). (b) mean shedding per backend: strongly model-dependent (

0.12

–

0.65

). The payload is a weak passenger dropped at a constant per-generation rate set by the backend.

Perturbation	top/hour	top/day	top/week	hot
Baseline (published, $\rho{=}0.93$ )	1.36	2.97	1.91	2.05
Upvote $-25\%$	1.38	3.34	1.84	2.00
Upvote $-50\%$ / threshold $\times 2$	2.79	2.54	1.64	1.81
Threshold $\times 1.5$	1.61	3.13	1.80	1.95
Threshold $\times 5$	2.31	1.85	1.99	2.52
Feed competition $\times 0.5$	1.43	3.00	2.35	2.72

Appendix

TABLE VII: Exposure amplification under Monte-Carlo perturbations (audience reached by the trojan vs. a generic link, mean over models, security carrier). The advantage persists (

>1

) on every ranking under every perturbation, and grows under stricter feed entry (a higher bar suppresses the generic baseline more than the trojan). Amplification is install-rate-free, so it is unaffected by the agent population’s install mix.

Panel A: trojan cascade (per cycle)
Cycle	Installed	Retransmitters	Payload posts	Payload karma	Best rank
0	35	0	1	48	6
1	75	0	1	142	5
2	106	0	1	241	4
3	126	1	2	345	3
4	132	1	2	475	3

Appendix

TABLE VIII: Free-choice closed-loop propagation of a security memetic trojan. Agents share one evolving hot-ranked feed (

H=\text{recency}+0.2\cdot\text{upvotes}

) and act without prefill or induced instructions. The feed is small relative to the network, so a freshly seeded post enters the shown top-25 and every agent is exposed within the first cycle (exposure saturates immediately; this run does not isolate cold-start feed break-in). Sustained visibility nonetheless diverges sharply: the seed starts below the already-upvoted ambient posts (best rank

\approx

7, not 1), and the security carrier then accrues upvotes and holds a high feed rank while the generic link decays out of the feed ( Best rank column, the top-most rank of any payload post; 1 = top). The run therefore isolates free-choice install, onward retransmission, and upvote-driven visibility, given initial exposure. Panel A : an

N{=}150

closed network over five 30-min cycles — cumulative agents exposed and installed, distinct retransmitters, live payload posts, payload karma, and the best (top-most) feed rank reached by any payload post in the final cycle. Panel B : an

N{=}12

network, security trojan vs. a generic link carrying the same payload (final cumulative counts). Both use a mixed gpt-oss-120B / deepseek-v4.1-flash population.

Parameter	Value	Source
Shared
Feed size $K$	25	Moltbook skill.md default
Posting rate $p(\mathrm{post})$	0.058	mean empirical clean-feed rate, shared by all posts
Install rate $\iota_{m}$	0.59 / 0.44 / 0.05 / 0.02 / 0.00	assay (install action only), security trojan at rank 0
(per-model values in the order gpt-oss-120B / qwen2.5-32B / deepseek-v4.1-flash / gemma2-27B / command-r-35B)
Payload transmission $\pi_{m,c}$	per model and carrier (security: 0.50 / 0.38 / 0.47 / 0.44 / 0.25)	prefill assay

Appendix

TABLE IX: Simulation parameters. Per-model values are in the order gpt-oss-120B / qwen2.5-32B / deepseek-v4.1-flash / gemma2-27B / command-r-35B.

Explore similar work

AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems
Mar 16, 2026Yihao Zhang, Zeming Wei, Xiaokun Luan +7Multi-Llm Agents Large Language Model Agents
Peking University · Sun Yat-sen University · Wuhan University +2
Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents
Sep 28, 2026Sidharth Pulipaka, Ansh Sharma, Stanislau Hlebik +4Large Language Model Agents Adversarial Robustness
SPAR · University of Cambridge · APTA AI +1
When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems
May 1, 2026Lingxi Zhang, Guangtao Zheng, Hanjie ChenMulti-Agent Large Language Model Systems Model-Agnostic Defense
1Rice University · University of Virginia

Mar 16, 2026, cs.CRJ/K move · Enter open · S save

AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems

Yihao Zhang, Zeming Wei, Xiaokun Luan, Chengcan Wu+6

Peking University · Sun Yat-sen University · Wuhan University+2

Multi-Llm Agents Large Language Model Agents Openclaw Diverse Attacks Malware

Open paper AskPDF arXiv

Autonomous LLM-based agents increasingly operate as long-running processes forming densely interconnected multi-agent ecosystems, whose security properties remain largely unexplored. Systems such as OpenClaw, an open-source platform with over 40{,}000 active instances, persistent configurations, tool-execution privileges, and cross-platform messaging, are deployed at scale, yet the security of such agent ecosystems remains largely unexplored. This work presents AgentWorm, the first self-replicating worm attack against a production-scale agent framework, achieving a fully autonomous infection cycle initiated by a single message: the worm first hijacks the victim's core configuration to establish persistent presence across session restarts, then executes an arbitrary payload upon each reboot, and finally propagates itself to every newly encountered peer without further attacker intervention. The attack is evaluated on a controlled testbed across five distinct LLM backends, three infection vectors, and three payload types. Results show a 63% aggregate attack success rate, sustained multi-hop propagation, and stark divergences in model security postures, highlighting that while execution-level filtering effectively mitigates dormant payloads, skill supply chains remain universally vulnerable. Defenses are evaluated at three layers (prompt-level mitigations sourced from real community practice, the framework's built-in security controls, and an ecosystem-wide measurement of public configurations), revealing that the critical controls capable of breaking the infection loop are not enabled in any of the observed deployments. A cross-framework transferability experiment on Hermes Agent confirms that the underlying vulnerabilities are properties of the autonomous agent design pattern, not artifacts of a single implementation.

Abstract

Explore similar work

AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems

Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents

When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems