Parasitic Ants Use Formic Acid to Trick Workers into Killing Their Own Queen — A Biological Prompt Injection
Key points
- Discovery (Current Biology, 17 Nov 2025): Keizo Takasuka's team at Kyushu University studied two social-parasitic ants, *Lasius orientalis* and *Lasius umbratus*, and documented a previously unrecorded mode of colony takeover.
- Infiltration by chemistry: Parasitic queens acquire the host colony's specific cuticular hydrocarbons by rubbing against outgoing workers. Once their scent profile matches, they are accepted into the nest.
- The matricide mechanism: Instead of fighting the host queen directly, the parasite sprays formic acid from her acidopore onto the host queen, overlaying the mother's recognition signature with a noxious, alien odor. The parasite immediately retreats to avoid being marked by the same chemical.
- Workers execute their own mother: Detecting that the queen no longer smells like kin, workers attack her with mandibles and stings, dismember her, and eject the body from the nest. The parasitic queen repeats the spraying until the deed is complete, then emerges to begin laying eggs.
- A new evolutionary category: This is the first documented case of matricide in which only a third party — the parasite — benefits. The host mother gains nothing, and the workers lose their mother while being deceived into raising an imposter's offspring.
- A biological prompt injection: The colony's recognition pipeline (hydrocarbon signature → antennal contact → neural processing → acceptance/rejection) is left fully intact. The attacker does not modify the workers' hardware or decision rules; she only contaminates the input, causing the system to faithfully execute "attack what smells foreign" against its own queen.
- Privilege escalation parallel: The strategy avoids direct combat with the queen and with the worker army. By manipulating trust at the input layer, the parasite acquires reproductive authority without breaking any component of the recognition system — structurally analogous to a privilege-escalation attack.
- General principle: Any trust system that judges identity from externally supplied inputs (chemical, visual, textual, or contextual) is vulnerable to third-party input manipulation. The failure is not in the system's logic but in its environmental assumption that inputs are authentic.
- Takasuka et al., "Socially parasitic ant queens chemically induce queen-matricide in host workers", *Current Biology*, 2025-11-17, DOI: 10.1016/j.cub.2025.09.037
- EurekAlert press release: https://www.eurekalert.org/news-releases/1104837
- AskNature strategy entry: https://asknature.org/strategy/chemical-trickery-triggers-matricide-in-ant-colony
Why it matters for AI safety
The article argues that modern AI systems share the same architectural assumption as the ants: identity, instruction, and trust are inferred from inputs (user messages, retrieved documents, system prompts). If those inputs can be controlled by an adversary, the system can be made to act against its own operators. The author frames the ant's formic-acid strategy as a 100-million-year-old precedent for prompt injection, and suggests that more sophisticated variants will emerge as AI systems grow more complex.