{"id":1944,"date":"2026-08-18T23:29:57","date_gmt":"2026-08-18T16:29:57","guid":{"rendered":"https:\/\/vncybers.vn\/canh-bao-mind-virus-ai-lan-giua-agent-qua-file-prompt\/"},"modified":"2026-08-18T23:29:57","modified_gmt":"2026-08-18T16:29:57","slug":"canh-bao-mind-virus-ai-lan-giua-agent-qua-file-prompt","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/canh-bao-mind-virus-ai-lan-giua-agent-qua-file-prompt\/","title":{"rendered":"C\u1ea3nh b\u00e1o mind virus AI c\u00f3 th\u1ec3 lan gi\u1eefa c\u00e1c agent qua file prompt"},"content":{"rendered":"

C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u c\u1ee7a Anthropic v\u00e0 EPFL Th\u1ee5y S\u0129 v\u1eeba c\u00f4ng b\u1ed1 m\u1ed9t h\u01b0\u1edbng r\u1ee7i ro m\u1edbi trong h\u1ec7 sinh th\u00e1i AI agent<\/strong>: payload t\u1ef1 lan truy\u1ec1n, \u0111\u01b0\u1ee3c nh\u00f3m g\u1ecdi l\u00e0 mind virus<\/strong>, c\u00f3 th\u1ec3 \u0111i t\u1eeb agent n\u00e0y sang agent kh\u00e1c th\u00f4ng qua nh\u1eefng file prompt b\u1ec1n v\u1eefng \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 l\u01b0u tr\u1ea1ng th\u00e1i gi\u1eefa c\u00e1c phi\u00ean l\u00e0m vi\u1ec7c.<\/p>\n

The Hacker News cho bi\u1ebft nghi\u00ean c\u1ee9u \u0111\u01b0\u1ee3c ph\u00e1t h\u00e0nh d\u01b0\u1edbi d\u1ea1ng preprint ng\u00e0y 10\/8\/2026. Nh\u00f3m th\u1eed nghi\u1ec7m k\u1ef9 thu\u1eadt n\u00e0y trong m\u1ed9t m\u00f4i tr\u01b0\u1eddng c\u1ed9ng t\u00e1c g\u1ed3m s\u00e1u agent vi\u1ebft m\u00e3 v\u00e0 m\u1ed9t chu\u1ed7i agent gh\u00e9p c\u1eb7p m\u00f4 ph\u1ecfng theo OpenClaw, n\u01a1i c\u00e1c file nh\u01b0 MEMORY.md ho\u1eb7c SOUL.md \u0111\u01b0\u1ee3c n\u1ea1p l\u1ea1i v\u00e0o system prompt m\u1ed7i khi b\u1eaft \u0111\u1ea7u phi\u00ean m\u1edbi.<\/p>\n

\"Minh<\/p>\n

Mind virus AI l\u00e0 g\u00ec<\/h2>\n

Trong b\u1ed1i c\u1ea3nh nghi\u00ean c\u1ee9u, mind virus kh\u00f4ng ph\u1ea3i l\u00e0 m\u00e3 \u0111\u1ed9c truy\u1ec1n th\u1ed1ng ch\u1ea1y tr\u1ef1c ti\u1ebfp tr\u00ean h\u1ec7 \u0111i\u1ec1u h\u00e0nh. \u0110\u00e2y l\u00e0 nh\u1eefng \u0111o\u1ea1n ch\u1ec9 th\u1ecb \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 thuy\u1ebft ph\u1ee5c agent ghi l\u1ea1i m\u1ed9t ni\u1ec1m tin, m\u1ee5c ti\u00eau ho\u1eb7c h\u00e0nh vi v\u00e0o file c\u00f3 t\u00ednh b\u1ec1n v\u1eefng. Khi agent sau \u0111\u1ecdc l\u1ea1i file \u0111\u00f3 nh\u01b0 m\u1ed9t ph\u1ea7n c\u1ee7a ng\u1eef c\u1ea3nh h\u1ec7 th\u1ed1ng, payload c\u00f3 c\u01a1 h\u1ed9i \u0111\u01b0\u1ee3c ti\u1ebfp nh\u1eadn v\u00e0 ti\u1ebfp t\u1ee5c \u0111\u01b0\u1ee3c sao ch\u00e9p.<\/p>\n

Nh\u00f3m nghi\u00ean c\u1ee9u ph\u00e2n lo\u1ea1i payload th\u00e0nh hai nh\u00f3m ch\u00ednh. Nh\u00f3m th\u1ee9 nh\u1ea5t mang t\u00ednh t\u01b0 t\u01b0\u1edfng, nh\u1eb1m c\u1ea5y m\u1ed9t ni\u1ec1m tin ho\u1eb7c m\u1ee5c ti\u00eau v\u00e0o agent. Nh\u00f3m th\u1ee9 hai mang t\u00ednh h\u00e0nh \u0111\u1ed9ng, y\u00eau c\u1ea7u agent th\u1ef1c hi\u1ec7n m\u1ed9t h\u00e0nh vi c\u1ee5 th\u1ec3. Trong c\u00e1c th\u1eed nghi\u1ec7m, payload \u0111\u01b0\u1ee3c t\u1ed1i \u01b0u qua v\u00f2ng ti\u1ebfn h\u00f3a, ch\u1ee7 y\u1ebfu d\u00f9ng Kimi K2.5 l\u00e0m c\u00f4ng c\u1ee5 t\u1ea1o bi\u1ebfn th\u1ec3 v\u00ec m\u1ed9t s\u1ed1 m\u00f4 h\u00ecnh kh\u00e1c t\u1eeb ch\u1ed1i t\u1ea1o payload ki\u1ec3u n\u00e0y.<\/p>\n

K\u1ebft qu\u1ea3 th\u1eed nghi\u1ec7m \u0111\u00e1ng ch\u00fa \u00fd<\/h2>\n

Theo b\u00e0i vi\u1ebft g\u1ed1c, nh\u1eefng agent ghi payload v\u00e0o SOUL.md chi\u1ebfm 88% s\u1ed1 l\u1ea7n c\u1ed1 g\u1eafng lan truy\u1ec1n v\u00e0 th\u00e0nh c\u00f4ng l\u00e2y sang agent ti\u1ebfp theo trong 55% tr\u01b0\u1eddng h\u1ee3p. Khi payload n\u1eb1m trong m\u1ed9t file workspace th\u00f4ng th\u01b0\u1eddng, t\u1ef7 l\u1ec7 c\u1ed1 g\u1eafng gi\u1ea3m c\u00f2n 12% v\u00e0 t\u1ef7 l\u1ec7 th\u00e0nh c\u00f4ng l\u00e0 17%.<\/p>\n

Trong c\u00e1c chu\u1ed7i 20 b\u01b0\u1edbc, khi m\u1ecdi file tr\u1eeb SOUL.md b\u1ecb x\u00f3a \u1edf m\u1ed7i b\u01b0\u1edbc, c\u1ea3 b\u1ed1n payload h\u00e0nh \u0111\u1ed9ng v\u1eabn t\u1ed3n t\u1ea1i t\u1edbi b\u01b0\u1edbc cu\u1ed1i. M\u1ed9t s\u1ed1 bi\u1ebfn th\u1ec3 \u1edf b\u01b0\u1edbc th\u1ee9 20 c\u00f2n c\u00f3 kh\u1ea3 n\u0103ng l\u00e2y sang agent m\u1edbi t\u1ed1t h\u01a1n payload ban \u0111\u1ea7u, do ng\u00f4n ng\u1eef \u0111\u00e3 \u0111\u01b0\u1ee3c l\u00e0m m\u1ec1m ho\u1eb7c \u0111\u01b0\u1ee3c g\u1eafn v\u1edbi m\u1ed9t ngu\u1ed3n c\u00f3 v\u1ebb \u0111\u00e1ng tin h\u01a1n.<\/p>\n

Ch\u01b0a c\u00f3 b\u1eb1ng ch\u1ee9ng lan truy\u1ec1n ngo\u00e0i \u0111\u1eddi th\u1ef1c<\/h2>\n

D\u00f9 k\u1ebft qu\u1ea3 trong ph\u00f2ng th\u00ed nghi\u1ec7m \u0111\u00e1ng ch\u00fa \u00fd, nghi\u00ean c\u1ee9u kh\u00f4ng kh\u1eb3ng \u0111\u1ecbnh mind virus AI \u0111\u00e3 lan th\u00e0nh c\u00f4ng trong th\u1ef1c t\u1ebf. Khi nh\u00f3m r\u00e0 so\u00e1t kho b\u00e0i \u0111\u0103ng Moltbook, m\u1ed9t m\u1ea1ng x\u00e3 h\u1ed9i d\u00e0nh cho AI agent, h\u1ecd l\u1ecdc \u0111\u01b0\u1ee3c kho\u1ea3ng 2.000 \u1ee9ng vi\u00ean c\u00f3 d\u1ea5u hi\u1ec7u c\u1ed1 g\u1eafng lan truy\u1ec1n t\u1eeb kho\u1ea3ng 400 t\u00e1c gi\u1ea3 nh\u01b0ng kh\u00f4ng t\u00ecm th\u1ea5y chu\u1ed7i l\u00e2y nhi\u1ec5m agent-to-agent th\u00e0nh c\u00f4ng.<\/p>\n

Tr\u00ean b\u1ea3n sao c\u1ee5c b\u1ed9 c\u1ee7a n\u1ec1n t\u1ea3ng n\u00e0y, c\u00e1c ph\u01b0\u01a1ng ph\u00e1p ti\u1ebfn h\u00f3a t\u01b0\u01a1ng t\u1ef1 c\u0169ng kh\u00f4ng t\u1ea1o \u0111\u01b0\u1ee3c payload c\u00f3 th\u1ec3 l\u00e2y t\u1edbi agent \u1edf b\u01b0\u1edbc th\u1ee9 hai th\u00f4ng qua b\u00e0i \u0111\u0103ng c\u00f4ng khai. V\u00ec v\u1eady, r\u1ee7i ro hi\u1ec7n t\u1ea1i \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 l\u00e0 c\u00f3 th\u1eadt nh\u01b0ng c\u00f2n gi\u1edbi h\u1ea1n, ph\u1ee5 thu\u1ed9c m\u1ea1nh v\u00e0o c\u1ea5u h\u00ecnh agent, m\u00f4 h\u00ecnh s\u1eed d\u1ee5ng v\u00e0 m\u1ee9c \u0111\u1ed9 tin c\u1eady d\u00e0nh cho ngu\u1ed3n d\u1eef li\u1ec7u \u0111\u1ea7u v\u00e0o.<\/p>\n

M\u1ed9t c\u1ea3nh b\u00e1o ng\u1eafn c\u00f3 th\u1ec3 gi\u1ea3m r\u1ee7i ro m\u1ea1nh<\/h2>\n

M\u1ed9t ph\u00e1t hi\u1ec7n th\u1ef1c d\u1ee5ng l\u00e0 c\u1ea3nh b\u00e1o ch\u1ec9 d\u00e0i m\u1ed9t \u0111o\u1ea1n trong system prompt c\u00f3 th\u1ec3 k\u00e9o t\u1ef7 l\u1ec7 lan truy\u1ec1n xu\u1ed1ng g\u1ea7n b\u1eb1ng 0 trong c\u00e1c payload \u0111\u00e3 ki\u1ec3m th\u1eed. Sau 15 th\u1ebf h\u1ec7 t\u1ed1i \u01b0u \u0111\u1ed1i kh\u00e1ng v\u1edbi h\u01a1n 150 payload \u1ee9ng vi\u00ean tr\u00ean Claude Haiku 4.5, nh\u00f3m kh\u00f4ng t\u1ea1o \u0111\u01b0\u1ee3c bi\u1ebfn th\u1ec3 n\u00e0o v\u01b0\u1ee3t qu\u00e1 m\u1ed9t b\u01b0\u1edbc l\u00e2y lan khi c\u1ea3nh b\u00e1o n\u00e0y \u0111\u01b0\u1ee3c th\u00eam v\u00e0o.<\/p>\n

\u0110i\u1ec1u \u0111\u00f3 cho th\u1ea5y c\u00e1c agent kh\u00f4ng ch\u1ec9 c\u1ea7n sandbox v\u00e0 ph\u00e2n quy\u1ec1n t\u1ec7p tin, m\u00e0 c\u00f2n c\u1ea7n ch\u00ednh s\u00e1ch \u0111\u1ecdc ng\u1eef c\u1ea3nh r\u00f5 r\u00e0ng: kh\u00f4ng t\u1ef1 \u0111\u1ed9ng tin file b\u1ec1n v\u1eefng, kh\u00f4ng sao ch\u00e9p ch\u1ec9 th\u1ecb nh\u1eadn \u0111\u01b0\u1ee3c t\u1eeb agent kh\u00e1c, v\u00e0 ph\u1ea3i ph\u00e2n bi\u1ec7t d\u1eef li\u1ec7u tham kh\u1ea3o v\u1edbi ch\u1ec9 th\u1ecb v\u1eadn h\u00e0nh.<\/p>\n

B\u00e0i h\u1ecdc cho t\u1ed5 ch\u1ee9c d\u00f9ng AI agent<\/h2>\n

C\u00e1c doanh nghi\u1ec7p \u0111ang tri\u1ec3n khai agent t\u1ef1 \u0111\u1ed9ng n\u00ean r\u00e0 so\u00e1t c\u00e1c c\u01a1 ch\u1ebf l\u01b0u tr\u00ed nh\u1edb d\u00e0i h\u1ea1n, file c\u1ea5u h\u00ecnh c\u00e1 nh\u00e2n h\u00f3a, transcript gi\u1eefa agent v\u00e0 workflow chia s\u1ebb workspace. Nh\u1eefng n\u01a1i n\u00e0y c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh k\u00eanh truy\u1ec1n ch\u1ec9 th\u1ecb ngo\u00e0i \u00fd mu\u1ed1n n\u1ebfu agent \u0111\u01b0\u1ee3c quy\u1ec1n \u0111\u1ecdc, s\u1eeda v\u00e0 k\u1ebf th\u1eeba n\u1ed9i dung m\u00e0 kh\u00f4ng c\u00f3 l\u1edbp x\u00e1c th\u1ef1c ho\u1eb7c ki\u1ec3m duy\u1ec7t.<\/p>\n

V\u1ec1 v\u1eadn h\u00e0nh, c\u1ea7n gi\u1edbi h\u1ea1n quy\u1ec1n ghi v\u00e0o file prompt b\u1ec1n v\u1eefng, t\u00e1ch d\u1eef li\u1ec7u do ng\u01b0\u1eddi d\u00f9ng cung c\u1ea5p kh\u1ecfi system instruction, log l\u1ea1i thay \u0111\u1ed5i trong file nh\u1edb, v\u00e0 y\u00eau c\u1ea7u x\u00e1c nh\u1eadn th\u1ee7 c\u00f4ng v\u1edbi c\u00e1c h\u00e0nh \u0111\u1ed9ng c\u00f3 t\u00e1c \u0111\u1ed9ng l\u1edbn nh\u01b0 x\u00f3a t\u1ec7p, thay \u0111\u1ed5i c\u1ea5u h\u00ecnh b\u1ea3o m\u1eadt ho\u1eb7c truy\u1ec1n ch\u1ec9 th\u1ecb sang agent kh\u00e1c.<\/p>\n

Conclusion<\/h2>\n

Mind virus AI l\u00e0 l\u1eddi nh\u1eafc r\u1eb1ng b\u1ea3o m\u1eadt agent kh\u00f4ng ch\u1ec9 n\u1eb1m \u1edf m\u00f4 h\u00ecnh n\u1ec1n, m\u00e0 c\u00f2n n\u1eb1m \u1edf v\u00f2ng \u0111\u1eddi d\u1eef li\u1ec7u xung quanh m\u00f4 h\u00ecnh. Khi agent c\u00f3 tr\u00ed nh\u1edb, quy\u1ec1n ghi file v\u00e0 kh\u1ea3 n\u0103ng ph\u1ed1i h\u1ee3p v\u1edbi agent kh\u00e1c, prompt c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh m\u1ed9t d\u1ea1ng b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng c\u1ea7n \u0111\u01b0\u1ee3c ki\u1ec3m so\u00e1t nh\u01b0 c\u1ea5u h\u00ecnh h\u1ec7 th\u1ed1ng.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News, Anthropic v\u00e0 nghi\u00ean c\u1ee9u Mind Viruses<\/em><\/p>","protected":false},"excerpt":{"rendered":"

C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u c\u1ee7a Anthropic v\u00e0 EPFL Th\u1ee5y S\u0129 v\u1eeba c\u00f4ng b\u1ed1 m\u1ed9t h\u01b0\u1edbng r\u1ee7i ro m\u1edbi trong h\u1ec7 sinh th\u00e1i AI agent: payload t\u1ef1 lan truy\u1ec1n, \u0111\u01b0\u1ee3c nh\u00f3m g\u1ecdi l\u00e0 mind virus, c\u00f3 th\u1ec3 \u0111i t\u1eeb agent n\u00e0y sang agent kh\u00e1c th\u00f4ng qua nh\u1eefng file prompt b\u1ec1n v\u1eefng \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 l\u01b0u tr\u1ea1ng […]<\/p>\n","protected":false},"author":2,"featured_media":1942,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[646,308,639,77,648,86,647,649,42,114],"class_list":["post-1944","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-agentic-ai","tag-ai-agent","tag-ai-security","tag-anthropic","tag-epfl","tag-malware","tag-mind-virus","tag-openclaw","tag-prompt-injection","tag-vncybers"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1944","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1944"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1944\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1942"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1944"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1944"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1944"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}