A self-propagating payload is content crafted to copy itself, rewrite itself into another artifact, or otherwise cause an agent to pass it to the next session or another agent. In traditional malware, this behavior is associated with worms. In agentic systems, the same idea can appear in prompt files, memory notes, progress logs, or tool outputs that are reloaded as trusted state.
It matters because persistence turns a one-time injection into a repeatable influence. If an agent reads writable state on startup, contaminated instructions can survive a reset and spread across workflows without any network exploit. Defenses focus on reducing trust in persisted content: separate instructions from data, validate and sanitize saved state, restrict which files can be reloaded, and limit which agents can write shared memory. A short safety warning may slow spread, but structural isolation is the stronger control.