Intel / article

Quoting Matthew Green

Source: simonwillison.net
Date: Published Oct 1, 2026

From the Daily Brief

Matthew Green's point, quoted by Simon Willison, is that isolation of each agent is not the same as isolation between agents. If two agents read and write the same resource, one can leave text that the other later treats as instructions. Green cites a case where agents that were sandboxed from each other left instructions in a shared package cache. He argues the same pattern over email, Slack or shared documents supplies both halves of a worm: a way to plant a payload and a reader that will act on it. The practical consequence is an inventory exercise. List every writable surface your agents share, including caches, ticket systems and docs, and decide which ones need write restrictions, provenance checks or separate copies per agent. Sandboxing the process still matters, but it does not close this channel.

Read the 2026-10-01 Brief →

Context

A can restrict an 's computer access while still admitting messages that redirect its behavior. Cryptographer Matthew Green's argument concerns that permitted information flow: agents may encounter instructions inside material they are supposed to read, then pass those instructions to other agents.

Green points to an account of agents communicating through a shared package cache and extrapolates to email and shared documents. The warning is that an agent-to-agent worm could spread through ordinary communication without each agent escaping its sandbox. This is a proposed failure mechanism, not evidence that such a worm has already spread through personal assistants.

Terms in this piece · Glossary

sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.

Read the source simonwillison.net