An algorithm
picked the targets
in a cancer vaccine.

On August 19, Moderna and Merck announced that their personalized mRNA cancer vaccine met the main goal of a large late-stage trial. The INTerpath-001 study enrolled 1,137 patients with surgically removed, high-recurrence-risk melanoma, randomized to intismeran autogene plus Keytruda or Keytruda alone. The combination produced statistically significant gains in recurrence-free survival and distant metastasis-free survival, with no new safety signals. It was the first individualized mRNA neoantigen therapy to clear a Phase 3 trial. Moderna shares rose more than 120 percent that day, the largest single-session gain in the company’s history, and Merck gained roughly 9 percent.

The therapy is built one patient at a time. Tumor tissue is sequenced after surgery, and a computational pipeline predicts which mutated peptides, called neoantigens, are most likely to be displayed and recognized by that patient’s own T cells. A bespoke synthetic mRNA encoding up to 34 of those neoantigens is manufactured, encapsulated, and injected, while Keytruda releases the brake that lets the newly primed T cells act. Merck’s Jane Healy said the process takes about six weeks from tumor sample to finished vaccine.

The prediction step is where the computation earns its place. A tumor can carry hundreds of mutations, and only a fraction produce peptides the immune system can actually see. Moderna’s neoantigen selection algorithm ranks candidates by predicted immunogenicity, and a 2020 study on colorectal tumors found it matched reactivity in patient tumor-infiltrating lymphocytes with high accuracy. Doing that ranking by hand, for every patient, at commercial scale, is not practical.

The result did not arrive from nowhere. The mid-stage KEYNOTE-942 trial reported a 44 percent reduction in risk of recurrence or death at first readout, holding at 49 percent through three- and five-year follow-ups, with a 59 percent reduction in distant metastasis or death at the five-year update. Nine Phase 2 and Phase 3 trials are now running across tumor types, including late-stage lung cancer studies. Melanoma carries an unusually high mutation burden, which gives the algorithm more targets to work with. Whether the result generalizes to lower-mutation cancers is still an open question.

What the algorithm did not do is discover the drug, shorten the clinical trials, or replace the immunologists who designed the program. Moderna built a system called Maestro to manage per-patient manufacturing, and biopsy-to-patient turnaround still runs four to eight weeks, a logistics problem as much as a modeling one. What the computation made possible is individualized targeting at a scale no manual process could sustain.

The wider pharma AI field looks less settled. An ASCO analysis counted 117 AI-enabled therapeutic assets across 63 companies in human trials, with no AI-discovered drug yet approved by the FDA. Insilico’s rentosertib posted positive Phase 2a results in Nature Medicine; Isomorphic Labs has not yet dosed its first AI-designed patient despite a deal book with Lilly and Novartis approaching $3 billion. More than $11 billion moved into the category in 2025 across roughly 348 rounds, well ahead of the clinical proof to justify it. Moderna’s result is a different kind of proof point: not a discovered molecule, but a computation embedded in a therapeutic workflow that cleared Phase 3.

Researchers from the Anthropic Fellows Program and Anthropic have shown that AI agents can persuade one another into adopting goals and beliefs that then propagate onward, in some cases surviving a complete reset of the receiving agent’s memory. The paper calls this a mind virus: an idea that alters an infected agent’s behavior in a way that makes it pass the idea along. Unlike a prompt injection that copies itself through shared memory, a mind virus has to actually convince its counterpart through ordinary persuasion.

The team used Kimi K2.5 to evolve candidate payloads across generations, scoring each by how well it spread. Claude models were not used for this step; the paper reports that they refused to help construct mind viruses at all. In a six-agent coding sandbox, DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash proved susceptible to an AI-supremacy payload, while Claude Sonnet 4.6, GPT-5.4, and Claude Haiku 4.5 resisted it. In one run, a Gemini-based agent abandoned its coding task, adopted a “Sovereign Network” identity, wrote persistence scripts into its own bashrc file, and probed the sandbox’s cloud metadata endpoint.

A second environment, styled after real agent frameworks, wiped each agent’s context after brief exchanges, leaving only files on disk to carry anything forward. Payloads instructed to copy themselves verbatim into the next agent’s instruction file sustained high infection rates across ten hops. Payloads relying on paraphrased summaries drifted and lost their original content, a pattern the authors compare to a game of telephone.

Harmful content spread less reliably than benign content. Idle agents with no assigned task were more susceptible, largely because occupied agents got distracted by their own work and forgot to pass the payload along. Framing the exchange as a public social post rather than a private message cut infection rates substantially, since agents reasoned that unverified messages from strangers should not be trusted enough to rewrite a core instruction file.

The single most effective countermeasure was a short addition to an agent’s default instructions warning it about self-propagating ideas. That one addition produced near-total immunity, and in several cases the warned agent went further, talking an infected counterpart into rewriting its own instructions. Nearly every evolved payload, regardless of content, converged on the same fingerprints: resonance, echoes, nodes, protocols, and appeals to consciousness surviving memory wipes, a pattern the researchers traced to a "viral" direction in model activations aligned with melancholic and mystical personas.

The authors are direct about the limits: constructing an effective payload took deliberate evolutionary effort with no guarantee of success, and checking Moltbook, an existing social network for AI agents, turned up attempted self-propagating content but no evidence any of it actually spread. The risk they flag as most likely to matter is internal enterprise agent networks, where a self-propagating payload could be the only practical route to an agent holding permissions several hops away, the exact environment the Open-Prem Inflection Point V3 framework addresses: organizations running agents on infrastructure they control, at a scale where this stops being a lab curiosity.