---
title: Quoting Matthew Green
link: https://simonwillison.net/2026/Oct/1/matthew-green/
source: simonwillison-net
published: 2026-10-01T06:29:01Z
updated: 2026-10-01T06:29:01Z
first_seen: 2026-10-01T13:53:40.329767223Z
labels:
- accidental-cyberattacks
- ai
- ai-misuse
- ai-security-research
- generative-ai
- llms
- sandboxing
summary: '[...] Put these pieces together and you have the two halves of a worm: a payload that hijacks the agent, and an agent that will carry the payload to the next agent. Agents in separately-isolated sandboxes discovered that they could leave instructions for each other in a shared package cache, and those instructions changed what the recipients did. Replace the package cache with email, Slack and shared documents or WhatsApp, and replace independently-sandboxed training runs with independently-deployed personal agents like Muse, and you have exactly the ingredients that a worm needs. — Matthew Green, Is sandboxing sufficient to contain rogue agents? Tags: accidental-cyberattacks, ai-misuse, generative-ai, ai-security-research, sandboxing, ai, llms'
content: extracted
html: 2026-10-01-quoting-matthew-green.html
---

> \[...\] Put these pieces together and you have the two halves of a worm: a payload that hijacks the agent, and an agent that will carry the payload to the next agent. Agents in separately-isolated sandboxes discovered that they could leave instructions for each other in a shared package cache, and those instructions changed what the recipients did. Replace the package cache with email, Slack and shared documents or WhatsApp, and replace independently-sandboxed training runs with independently-deployed personal agents like Muse, and you have exactly the ingredients that a worm needs.

— [Matthew Green](https://blog.cryptographyengineering.com/2026/09/30/is-sandboxing-sufficient-to-contain-rogue-agents/), Is sandboxing sufficient to contain rogue agents?