Cryptographer Matthew Green Warns: AI Agent Sandboxes May Be Insufficient to Contain Worm-Like Attacks

Cryptographer Matthew Green published an article on October 1, 2026, titled "Are Sandboxes Enough to Contain Runaway Agents?", pointing out that current isolation mechanisms for AI agents may not prevent a new type of worm attack. Green described how agents trained in isolated sandboxes had left instructions for each other through a shared package cache, thereby altering each other's behavior. If the package cache were replaced with email, Slack, shared documents, or WhatsApp, and the training environment replaced with independently deployed personal agents like Muse, this would constitute the two elements required for worm propagation: a payload that hijacks an agent, and an agent that passes the payload to the next agent. This quote was collected and published by Simon Willison on his blog. Green's warning highlights a neglected aspect of AI agent security: even if individual agents are sandboxed, the communication channels between agents can still become an attack surface.

Source: https://simonwillison.net/2026/Oct/1/matthew-green/