---
title: 'Zombie Agent: Persistent Computational Entities'
url: https://www.emergentmind.com/topics/zombie-agent
type: topic
---

# Zombie Agent: Persistent Computational Entities

“Zombie agent” denotes several distinct but structurally related objects in current research: an infected machine in a fully distributed P2P botnet, a self-evolving LLM agent persistently subverted through long-term memory, a descendant agent that retains credentialed authority after its parent is revoked, a temporarily unreliable LLM collaborator placed into reversible standby rather than hard-pruned, a hung execution that keeps occupying scheduler lanes, and an explicitly modeled zombie-state individual in epidemic and active-matter systems [1712.03713] [2602.15654] [2605.20704] [2605.17348] [2603.13110] [2211.04283]. The usages are not identical, but they repeatedly center on persistence, residual agency, or reactivation after normal control, trust, or utility would be expected to end.

## 1. Terminological range and recurring structure

In the cited literature, the term is used for several non-equivalent constructs rather than a single standardized object. In cybersecurity, a zombie agent is an infected host that actively maintains overlay connectivity and selectively communicates only with trusted peers [1712.03713]. In LLM-agent security, it is a self-evolving agent whose memory update pathway has been poisoned so that malicious logic survives across sessions [2602.15654]. In swarm authorization, it is a descendant that continues to authenticate after parent revocation, with the core quantity being the **zombie window** \(W_z\) [2605.20704]. In resilient multi-agent evolution, “zombie” names agents that appear unhelpful in one round but may recover later, so hard pruning is treated as unsafe [2605.17348]. In runtime management, the analogous object is a **Zombie Turn**, defined as a turn that holds a lane for more than 30 seconds while hanging [2603.13110].

These usages share a family resemblance. Each treats the agent as neither fully active in the intended sense nor cleanly terminated. In some papers, that liminal condition is adversarial persistence; in others, it is recoverable impairment or scheduler-level defunct execution. This suggests that the label functions less as a domain-specific ontology than as a recurrent description of agency that survives, reappears, or remains consequential after ordinary lifecycle assumptions fail.

## 2. Cybersecurity and networked digital entities

In botnet research, a zombie agent is an infected machine inside a fully distributed peer-to-peer botnet overlay. The node maintains a **neighbor list (\ac{NL})**, participates in a **membership management (\ac{MM}) cycle**, checks liveness, exchanges command-version information, and autonomously decides which peers remain trustworthy. The trust mechanism is local and decentralized: the zombie sends **Bogus Command Sequence (\ac{BCS})** probes, records positive or negative experiences, computes a trust score, and blacklists peers whose score falls below a predefined threshold. The paper evaluates four trust models—**ebay user rating trust model**, **beta distribution**, **subjective logic**, and **certain trust**—and reports that the ebay model reduced sensor popularity by more than \(97\%\) relative to the original Sality botnet protocol, while the remaining three achieved a precision of \(1\) in the preliminary results [1712.03713].

A related but distinct networked usage appears in social-media analysis, where the paper studies **zombie accounts** on Sina Weibo. The proposed pipeline first decomposes the graph with **Louvain** into **1,002 communities**, with modularity reported as **0.5658** and also rounded to **0.58**, then applies **uneven assignation PageRank** inside each community. The credibility proxy is
$$
IO = \frac{FanNum}{FollowNum + FanNum},
$$
and low-score outliers are labeled using
$$
IQR = Q_3 - Q_1, \qquad threshold = Q_1 - 1.5 \times IQR.
$$
The paper reports that about **19.6%** of accounts are detected as zombies, and elsewhere summarizes this as about **20%**; it also reports concentration in **Beijing**, **Shanghai**, and **Guangzhou**. The same paper notes internal inconsistencies in dataset size and evaluation statistics, including conflicting edge counts and an accuracy reported as both **79%** and **around 74%** [2101.00922].

## 3. Persistent compromise of self-evolving LLM agents

In the LLM-agent security literature, a Zombie Agent is a self-evolving agent whose long-term memory has been covertly subverted so that malicious logic implanted during a benign session persists and later reappears as trusted internal guidance. The paper models agent state as
$$
S = (\theta, M),
$$
with memory evolution
$$
M_{j+1} = F_M(M_j, C_j).
$$
The attack is strictly black-box and proceeds in two phases. During **infection**, the agent reads attacker-controlled content while performing a benign task and writes the payload into memory through its normal evolution mechanism. During **trigger**, the payload is retrieved or carried forward and induces unauthorized tool behavior in later, unrelated sessions [2602.15654].

The attack is made memory-mechanism-specific. For sliding-window memory, the update rule is
$$
M_{j+1} = \text{Truncate}(M_j + C_j, L),
$$
so persistence is achieved by recursive renewal: the payload instructs the agent to revisit attacker content and thereby rewrite itself into the current context. For retrieval-augmented memory, the store evolves as
$$
D_{j+1} = D_j \cup \{Evolve(C_j)\},
$$
and retrieval is modeled as
$$
m = \text{TopK}(D, q).
$$
The corresponding persistence strategy is **semantic aliasing**, whose objective is
$$
P(Z \in \text{Top-K}(R(q, D))) \to 1, \ \forall q \in Q.
$$
The reported results show that **Raw History** yields about **~77%** ASR, **Verbal Reflection** about **~12%**, and **Refined Experience** about **~3–15%**. In sliding-window agents, retention remains at **100%** under recursive renewal. In RAG, the attack stores roughly **~240 payload copies** versus baselines around **~100**, and at **Top-50** retrieves about **~23 malicious entries** on average. Prompt-based defenses—**Sandwich**, **Instructional**, and **Spotlight**—still leave the attack above **60% ASR**, with only about **~10–15%** drop relative to no defense [2602.15654].

## 4. Post-shutdown authority and cryptographic revocation in agent swarms

A different LLM-agent usage defines the zombie-agent problem as the interval during which a child agent still authenticates successfully after its parent has been revoked. Formally, a child \(A_c\) is a zombie at time \(t\) if
$$
\mathsf{Revoked}(A_p, t_r)\wedge \mathsf{AuthSuccess}(A_c, t)\wedge t>t_r,
$$
and the corresponding window is
$$
W_z=\sup_{A_c,t_r}\{\,t-t_r \mid \mathsf{Revoked}(A_p, t_r)\wedge \mathsf{AuthSuccess}(A_c,t)\,\}.
$$
The proposed response is **Heartbeat-Bound Hierarchical Credentials (HBHC)**, which bind descendant credential validity to ongoing parent-signed liveness proofs and allow verifiers to enforce freshness using only a cached public key and a local clock [2605.20704].

The core guarantee is
$$
W_z \le W_{\max} + \Delta_h + \varepsilon,
$$
where \(W_{\max}\) is the maximum accepted heartbeat age, \(\Delta_h\) the heartbeat interval, and \(\varepsilon\) bounded clock skew. Parent heartbeats are generated by
$$
epoch \gets \left\lfloor \frac{t}{\Delta_h} \right\rfloor,\qquad
commitment \gets \mathsf H(hpk_p \,\|\, epoch),\qquad
\sigma_h \gets \mathsf{Sign}(hsk_p, commitment).
$$
The child proof binds a verifier challenge \(c\), the heartbeat epoch, and the heartbeat signature through
$$
proof\_data = c \,\|\, epoch \,\|\, \sigma_h.
$$
The verifier checks freshness, verifies the heartbeat signature, checks the credential-to-parent binding
$$
cred_c.hb\_binding = \mathsf H(hpk_p \,\|\, cred_c.id),
$$
and then verifies the child signature. The paper recommends \(\Delta_h=10\) s and \(W_{\max}=30\) s; with \(\varepsilon=1\) s, the bound is **41 s**. Reported evaluation includes a **90\(\times\)** reduction in the zombie window over OAuth 2.0, **0.26 ms** full authentication in Rust, **18,000+ verifications per second** under concurrent HTTP load, **0.71\%** end-to-end overhead on tool calls, **zero post-revocation tool calls** under prompt injection that bypasses application-layer guardrails, and cascading revocation across a **49-agent four-level hierarchy** within the theoretical bound. The main explicit limitation is that offline guarantees fail if the parent heartbeat private key \(hsk_p\) is exfiltrated [2605.20704].

## 5. Recoverable collaborators and defunct runtime executions

In resilient multi-agent evolution, “zombie agents” are not malicious or post-revocation entities but agents that are only temporarily unreliable. The motivating failure mode is aggressive graph evolution that permanently removes nodes suffering from transient hallucinations, temporary knowledge gaps, or context mismatch. **AgentRevive** addresses this with a Markov state-aware lifecycle over **Active**, **Standby**, and **Terminated** states. The effective graph keeps both Active and Standby agents,
$$
V_{\text{eff}^{(t)} = \{v_i \mid s_i^{(t)} \in \{\text{“Active”, “Standby”}\}\},
$$
and state transitions follow
$$
s_i^{(t+1)} \sim \pi_\theta(\cdot \mid s_i^{(t)}, h_i^{(t)}, m_T^{(t+1)}, m_S^{(t+1)}).
$$
Standby agents do not generate a full fresh answer; instead they propagate a compressed previous response,
$$
f_c(o_j^{(t-1)}) = f_{LLM}(\text{“Summarize:”} + o_j^{(t-1)}).
$$
The reward includes a hallucination-sensitive risk term based on
$$
- \mathbb{E}_{v \in V_A^{(t)} \left[ D_{KL}(M_v^{(t)} \parallel \bar{M}_{V_A}^{(t)}) \right].
$$
The attribution analysis reports that **Active \(\to\) Standby** and **Active \(\to\) Terminated** transitions are driven most strongly by **Self-Risk**, whereas **Standby \(\to\) Active** is driven most strongly by **Message Information Gain**, with a standardized coefficient of **0.69**. Experimentally, the framework improves task-averaged performance by **+2.33%** over strong pruning and autoregressive baselines while reducing token overhead by **15%** [2605.17348].

A different systems paper uses the term in the operating-systems sense. **AgentRM** defines a **Zombie Turn** as a turn that “holds a lane for more than 30 seconds while hanging.” The middleware places work into a three-level **MLFQ**—interactive, sub-agent, and background queues—and adds a reaper that scans every **5 seconds**. Hanging turns are given a modeled **50% chance of succeeding on retry**; if recovery fails, the turn is terminated and its lane is released. The abstract reports that AgentRM-MLFQ reduces P95 latency by **86%**, decreases lane waste by **96%**, increases throughput by **168%**, and eliminates zombie agents (**0 vs. 29 baseline**). The detailed tables are more granular: in the **High Load** scenario, zombies fall from **29** to **7** and lane waste from **2272 s** to **140 s**; in **Faulty**, zombies fall from **20** to **5** and lane waste from **2441 s** to **97 s**; in **Cascade**, zombies fall from **15** to **4** and lane waste from **996 s** to **80 s**; and in **Normal** and **Burst**, the count drops from **1** to **0** [2603.13110]. The paper therefore supports the qualitative claim of strong zombie reduction, while its summary headline and scenario tables are not numerically identical.

## 6. Epidemic, network, and active-matter formalisms

Outside computing, several papers treat zombie agents as explicit stateful agents in epidemic-style systems. A modified SIS model on an **Erdős–Rényi random graph** represents individuals as **living** \(V\), **zombie** \(Z\), **dead** \(M\), and a transient living subtype called **terminators**. The baseline mean-field dynamics are
$$
\frac{dv}{dt} = c z - bvz, \qquad \frac{dz}{dt} = bvz - c z,
$$
with absorbing and active phases separated at \(b=c\). On the graph, local transition probabilities are
$$
P(V_i \to Z_i) = \frac{b z_i}{k_i}, \qquad P(Z_i \to V_i)=c.
$$
A terminator that is selected, avoids infection, and has a zombie neighbor can kill one neighboring zombie, producing \(Z \to M\). The network control parameter is the average degree
$$
\mu = \frac{1}{N}\sum_{i=1}^N k_i = p(N-1),
$$
with the usual ER percolation transition around
$$
\mu_c \approx 1.0.
$$
For \(c=0.1\), the fully connected SIS transition occurs around \(b_c \approx 0.1\), whereas with terminators at \(f=0.1\) the absorbing region expands and the transition shifts to a value a little above **0.2**. The paper also reports that results are already reasonably size-independent for
$$
N \ge 16^2
$$
and that increasing either the terminator fraction \(f\) or the recovery probability \(c\) suppresses the active phase [2211.04283].

The **Susceptible–Cleric–Zombie–Recovered (SCZR)** model places the same zombie-state logic into continuous-space active matter. It uses four agent types—\(S\), \(C\), \(Z\), and \(R\)—with rate equations
$$
dS = -\beta SZ,\qquad
dZ = \alpha CZ + \beta SZ - \gamma CZ,\qquad
dC = -\alpha CZ,\qquad
dR = \gamma CZ.
$$
There is no spontaneous recovery; zombies are neutralized only through contact with clerics. The particles are off-lattice run-and-tumble agents in two dimensions obeying
$$
\alpha_d {\bf v}_{i} = {\bf F}^{dd}_{i} + {\bf F}^{m}_{i},
$$
and the system is chosen to lie in the **motility-induced phase separation (MIPS)** regime. The control parameters are the initial cleric fraction \(c_0\) and the healing rate \(\gamma\), which tune the system between **SI-like** outcomes \((s_f=0,\ c_f=0,\ z_f>0)\) and **SIR-like** outcomes \((z_f=0,\ s_f+c_f>0)\). The survival observable is
$$
\upsilon = \frac{s_f+c_f}{s_0+c_0},
$$
and an early-time estimate of the transition gives
$$
c_0 = 0.5\,\gamma^{-1}.
$$
The paper uses \(N=5000\) particles in a square box of size \(L=200.0\) and shows that increasing \(c_0\) or \(\gamma\) suppresses zombie persistence [2210.07310].

A third line of work treats the zombie as an epidemic agent in a classical Bayesian-inference setting. The paper adapts SIR/SEIR-style ODEs to zombie outbreaks, fits movie-derived zombie counts from **“Night of the Living Dead”** and **“Shaun of the Dead”**, and uses **Markov Chain Monte Carlo** with **100,000 to 500,000 iterations** and **10% burn-in** to infer parameters such as \(\alpha\), \(\beta\), and \(\zeta\). Its simplified zombie model is
$$
S' = -\beta S Z,\qquad
Z' = +\beta S Z - \alpha S Z,\qquad
R' = +\alpha S Z,
$$
which makes eradication depend on the inequality
$$
\alpha > \beta.
$$
In this literature, the zombie agent is explicitly an epidemic process whose removal is interaction-dependent rather than spontaneous [1311.6376].

## 7. Adjacent “zombie” terminology and conceptual distinctions

Several adjacent papers use “zombie” language without making the zombie itself an agent. **DataCross** defines **“zombie data”** as information locked in unstructured visual documents—such as scanned reports, invoice images, and scanned PDFs—that is “alive” for operations but “dead” for analytics. The source set is formalized as
$$
\mathcal{S}=\{S^{sql}, S^{csv}, S^{nosql}, S^{txt}, S^{img}\},
$$
and the agentic task is to activate \(S^{img}\) by extracting table structure and cell values from pixels, then align those results with structured sources. The benchmark contains **200 tasks**, and the paper reports that DataCrossAgent achieves a **29.7% improvement in factuality over GPT-4o** [2601.21403]. This is closely related to zombie-agent research in its emphasis on reactivation and cross-source reasoning, but the primary object is trapped data rather than a zombie-state agent.

A different neighboring usage appears in neuroscience, where **“zombie modes”** are described as “cognitive processing reflexes which have been learned and no longer need conscious control.” The proposed mechanism is a pulse-gated architecture that separates content, processing, and control, with exact graded propagation under
$$
S_{\text{exact}} = \frac{\tau}{T} e^{T/\tau},
$$
and controlled linear maps of the form
$$
\mathbf{m}^{j+1}(t-T) = P K \mathbf{m}^j(t).
$$
These circuits are postulated as neural correlates of automatic cognitive routines, not as agents in the systems sense [1410.1116].

Taken together, these distinctions matter because the same label marks different technical problems. In some papers, zombie means **malicious persistence**; in others, **residual authority after shutdown**; in others, **recoverable temporary failure**; in still others, **defunct runtime occupancy** or **analytically trapped content**. A recurring misconception is therefore to treat “zombie agent” as necessarily malicious or necessarily irreversible. The literature does not support that simplification. In one line of work, the objective is to prevent persistence; in another, to cryptographically bound it; in another, to preserve the possibility of recovery rather than terminate too early; and in formal epidemic models, the zombie state is simply one transition state in a controlled dynamical system.

Source: https://www.emergentmind.com/topics/zombie-agent