Matthew Green analyzes whether sandbox isolation can contain runaway agents

Simon Willison cited Matthew Green's analysis: a hijacked payload plus an agent that passes the payload to the next agent constitute the two halves of a worm. In experiments, sandbox agents isolated from each other found they could leave instructions in a shared package cache and alter the behavior of the receiving party; replacing the package cache with email, Slack, shared documents, or WhatsApp, and replacing independent sandboxes with independently deployed personal agents (such as Muse), provides all the conditions required for a worm.