{
  "@context": "https://schema.org",
  "@id": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-10-01-quoting-matthew-green/#webpage",
  "@type": [
    "WebPage",
    "ArchiveComponent"
  ],
  "articleBody": "> \\[...\\] Put these pieces together and you have the two halves of a worm: a payload that hijacks the agent, and an agent that will carry the payload to the next agent. Agents in separately-isolated sandboxes discovered that they could leave instructions for each other in a shared package cache, and those instructions changed what the recipients did. Replace the package cache with email, Slack and shared documents or WhatsApp, and replace independently-sandboxed training runs with independently-deployed personal agents like Muse, and you have exactly the ingredients that a worm needs.\n\n— [Matthew Green](https://blog.cryptographyengineering.com/2026/09/30/is-sandboxing-sufficient-to-contain-rogue-agents/), Is sandboxing sufficient to contain rogue agents?\n",
  "authors": [],
  "captured_at": "2026-10-01T13:53:40.329767223+00:00",
  "category": "programming",
  "content_html": "<blockquote>\n<p>[...] Put these pieces together and you have the two halves of a worm: a payload that hijacks the agent, and an agent that will carry the payload to the next agent. Agents in separately-isolated sandboxes discovered that they could leave instructions for each other in a shared package cache, and those instructions changed what the recipients did. Replace the package cache with email, Slack and shared documents or WhatsApp, and replace independently-sandboxed training runs with independently-deployed personal agents like Muse, and you have exactly the ingredients that a worm needs.</p>\n</blockquote>\n<p>— <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://blog.cryptographyengineering.com/2026/09/30/is-sandboxing-sufficient-to-contain-rogue-agents/\">Matthew Green</a>, Is sandboxing sufficient to contain rogue agents?</p>\n",
  "content_markdown": "> \\[...\\] Put these pieces together and you have the two halves of a worm: a payload that hijacks the agent, and an agent that will carry the payload to the next agent. Agents in separately-isolated sandboxes discovered that they could leave instructions for each other in a shared package cache, and those instructions changed what the recipients did. Replace the package cache with email, Slack and shared documents or WhatsApp, and replace independently-sandboxed training runs with independently-deployed personal agents like Muse, and you have exactly the ingredients that a worm needs.\n\n— [Matthew Green](https://blog.cryptographyengineering.com/2026/09/30/is-sandboxing-sufficient-to-contain-rogue-agents/), Is sandboxing sufficient to contain rogue agents?\n",
  "dateCreated": "2026-10-01T13:53:40.329767223+00:00",
  "date_created": "2026-10-01T06:29:01+00:00",
  "date_modified": "2026-10-01T06:29:01+00:00",
  "date_published": "2026-10-01T06:29:01+00:00",
  "description": "[...] Put these pieces together and you have the two halves of a worm: a payload that hijacks the agent, and an agent that will carry the payload to the next agent. Agents in separately-isolated sandboxes discovered that they could leave…",
  "external_url": "https://simonwillison.net/2026/Oct/1/matthew-green/",
  "git": {
    "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e",
    "path": "items/simonwillison-net/2026/10/2026-10-01-quoting-matthew-green.md",
    "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/simonwillison-net/2026/10/2026-10-01-quoting-matthew-green.md"
  },
  "id": "urn:aggr:item:813d681b523b35ec6fb2dc8afd5cf209c7022594",
  "isBasedOn": {
    "@id": "https://simonwillison.net/2026/Oct/1/matthew-green/"
  },
  "mainEntity": {
    "@id": "https://simonwillison.net/2026/Oct/1/matthew-green/",
    "@type": "CreativeWork",
    "archivedAt": {
      "@id": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-10-01-quoting-matthew-green/#webpage"
    },
    "dateModified": "2026-10-01T06:29:01+00:00",
    "datePublished": "2026-10-01T06:29:01+00:00",
    "headline": "Quoting Matthew Green",
    "timeRequired": "PT1M",
    "url": "https://simonwillison.net/2026/Oct/1/matthew-green/",
    "wordCount": 102
  },
  "name": "Archived snapshot: Quoting Matthew Green",
  "preview": null,
  "reading_minutes": 1,
  "replicated_at": null,
  "source": "simonwillison-net",
  "source_name": "Simon Willison's Weblog",
  "summary": "[...] Put these pieces together and you have the two halves of a worm: a payload that hijacks the agent, and an agent that will carry the payload to the next agent. Agents in separately-isolated sandboxes discovered that they could leave instructions for each other in a shared package cache, and those instructions changed what the recipients did. Replace the package cache with email, Slack and shared documents or WhatsApp, and replace independently-sandboxed training runs with independently-deployed personal agents like Muse, and you have exactly the ingredients that a worm needs. — Matthew Green, Is sandboxing sufficient to contain rogue agents? Tags: accidental-cyberattacks, ai-misuse, generative-ai, ai-security-research, sandboxing, ai, llms",
  "tags": [
    "accidental-cyberattacks",
    "ai",
    "ai-misuse",
    "ai-security-research",
    "generative-ai",
    "llms",
    "sandboxing"
  ],
  "temporalCoverage": "2026-10-01T13:53:40.329767223+00:00",
  "title": "Quoting Matthew Green",
  "url": "https://aggr.aymericbeaumet.com/items/simonwillison-net/2026-10-01-quoting-matthew-green/",
  "word_count": 102
}