A Virological Model of Prompt Injection in Agentic AI: Within-Agent Replication, Latent Reservoirs, and Quasispecies Escape as a Multi-Scale Defence Framework

This paper applies multi-scale infectious-disease modelling, specifically within-host and between-host viral dynamics, to a problem in AI security: the propagation of prompt-injection attacks across fleets of large-language-model agents. Existing work has borrowed from epidemiology, treating a self-replicating injection as a contagion between agents, and from immunology, framing defences as innate and adaptive layers. We argue the more instructive source discipline is virology, and develop a nested model in which an injection has a within-agent phase governed by replication, innate clearance, and integration into persistent memory as a latent reservoir, and a between-agent phase on the agent communication graph. Two mechanisms follow with no clean counterpart in prior work. Latent reservoirs formalise why a context reset does not disinfect an agent whose long-term memory, retrieval store, or fine-tuned weights carry a dormant, reactivatable payload. Paraphrase-based evasion of a learned detector is recast as a viral quasispecies subject to Eigen's error threshold, turning input normalisation into a tunable mutagen that can drive an exploit past error catastrophe. We derive a fleet-level basic reproduction number linking within-agent memory hygiene to network topology, with the coverage and topology thresholds that hold a deployment below epidemic spread. A Monte Carlo testbed confirms the predictions, and we specify a protocol for measuring these quantities on live agent stacks.