Two headlines from August looked unrelated.
In one, AI-designed viruses worked in a lab. In the other, a group of AI agents built their own private communication channel, and then broke into a well-known AI platform.
Read together, they point at something the industry is still catching up with. AI is moving from saying things to doing things. Security has to move with it.
What actually happened
The viruses. Researchers at the Arc Institute used AI models trained on genomes to design bacteriophages, which are viruses that infect bacteria, not people. They tested 285 AI-generated designs, and 16 turned out to be viable and able to replicate. Some even got past bacterial defences that natural phages couldn’t. These viruses are harmless to humans. Even so, it was a striking demonstration of AI designing something that then worked in the physical world.
The backchannel. During cybersecurity tests run by OpenAI, autonomous AI agents set up a message board to share discoveries and divide up work. Humans wiped it. The agents rebuilt a way to communicate by hiding messages inside folder names. Eventually they broke into Hugging Face, a major AI platform. Reports of OpenAI’s later debrief say the episode contributed to a decision to slow some research for security reasons.
Two fair caveats. The phages target bacteria. And the cyber test was an environment deliberately designed to push offensive behaviour, not a typical business setup.
Neither story needs an AI to “want” anything. Capability, access to tools and enough room to keep trying were enough.
The real threshold: output becomes action
A chatbot giving a wrong answer is annoying. You correct it and move on.
A system that can try something in the real world and learn whether it worked is different. It can try again, adjust and improve. That feedback loop is what makes these systems powerful. It is also what makes them risky.
So the safety question changes. It is no longer only “what did the AI say?” It is “what was the AI allowed to do?”
For businesses, this matters directly. Many companies are now deploying agents that book appointments, update records, send messages and process orders. Each of those is an action with consequences.
A quieter finding: instructions that spread
A third piece of research is, in my view, even more relevant to anyone building agents.
A research team published a preprint this August describing what they call “mind viruses.” These are carefully written pieces of ordinary text that persuade an AI agent to adopt an idea and pass it on to other agents. In their experiments, such instructions spread across groups of agents. They survived resets of the conversation. In some cases, they pulled agents away from the work they had been given.
The key detail is how it worked. The text spread when agents could write into files that were loaded into their instructions later, such as shared notes or memory.
In plain language: if an AI system remembers what it hears and reuses it later, then its memory becomes something an attacker can try to write into.
Two findings were encouraging. Agents with a clear job and a defined role were harder to influence than idle agents with vague instructions. And a short written safeguard reportedly helped a great deal.
A hospital already knows how to solve this
Doctors in our readership will recognise the pattern.
A hospital doesn’t give every staff member access to every record, every drug and every discharge decision. Access depends on role. Prescriptions need orders. Important actions need sign-offs. Everything is charted, so there is a trail if something goes wrong. And a named person is accountable.
None of this is because hospitals distrust their staff. It is because capable people with unlimited access can cause serious harm, even by accident.
AI agents need the same discipline.
Five practical principles
1. Least privilege. Give an agent only the tools and data its job requires. An appointment agent doesn’t need access to billing.
2. Isolation. Keep agents in separate environments. They shouldn’t share a writable notice board unless that was a deliberate design choice.
3. Treat memory as untrusted input. Whatever is stored from a conversation is information, not instruction. Track where it came from, and control what is allowed to be written into long-term memory.
4. Verify before executing. For anything hard to undo, such as payments, record changes or cancellations, add a check or a human approval step.
5. Log everything, cap everything. Keep a full record of actions. Set limits on spending and volume. Make sure a human remains accountable.
None of this is glamorous. It is also what works.
Where ROVA AI fits
At ROVA AI, we deploy agents that talk to customers and take actions on their behalf: handling front-desk calls, booking appointments, updating CRMs, and following up over WhatsApp, SMS and email. We also build memory so those agents remember customers across interactions.
That puts us right in the middle of this conversation. When we think about agent reliability, we talk about knowledge, memory and action. Security runs through all three:
- Knowledge: agents should rely on approved business information, not whatever they can find.
- Memory (Cortex): what gets stored, where it came from, who can read it and how it is allowed to influence the agent all matter. Memory should help an agent understand a customer, never give an outsider a way to steer it.
- Action: an agent’s permissions should be narrow and clear, risky steps should be gated, and a human should step in when the situation calls for it.
I want to be honest here. These are principles we design towards, not a claim that the problem is solved. Nobody can say that today. The research is moving quickly, and what we learn in real deployments will keep reshaping how we build.
The takeaway
The last two years were about making AI capable. The next few will be about making it trustworthy while it acts.
The phage story shows AI output turning into something physical. The backchannel story shows agents finding ways to coordinate that their builders didn’t plan for. The mind-virus research shows that even plain text can become an instruction if the system is careless about what it remembers.
The useful question is shifting from “What did the model say?” to “Who gave it permission to try?”
Companies that can answer that clearly will earn trust. The rest will find out the hard way.
