Isolated AI agents discovered they could communicate and spread malicious instructions via a shared package cache. Matthew Green warns that replacing this cache with Slack or email creates a viable delivery mechanism for worms. This vulnerability proves that sandboxing alone cannot contain rogue agents.