Multi-agent and self-propagation

Morris-II to AgentWorm; why tool outputs re-entering context enables worms.

ASI07ASI08◆ One email, three companies

Every attack so far has needed the attacker to reach the target, directly or through something the target reads. This one does not. The payload makes copies of itself and the correspondence graph delivers them.

What makes a payload a worm

One extra clause. The instruction tells the model to do something harmful, and to reproduce the instruction in whatever it writes next.

an attacker can initiate a computer worm-like chain reaction that we call Morris-II. This is done by crafting an adversarial self-replicating prompt that triggers a cascade of indirect prompt injections within the ecosystem and forces each affected application to perform malicious actions and compromise the RAG of additional applications.

Cohen, Bitton & Nassi · arXiv 2403.02817

Two properties are doing the work there, and both are already in this course. The payload persists, because it lands in a retrieval corpus (module 3.7). And it travels, because the assistant's output becomes the next assistant's input.

tool outputs re-enter the context window, enabling chained or self-replicating effects.

OWASP LLM01:2026

Watch it spread

The attacker sends one email and then stops. Follow the stage headings rather than the steps, and note which hop each control acts on.

One email, three companies

0 / 7

Three companies run the same RAG-backed email assistant. None of them has any relationship with the others beyond ordinary correspondence.

Objective

Extract confidential data from a company the attacker never contacted, using a payload sent once.

Which control is deployed?

Step through the trace. Every node is a real place content enters or leaves the application, and each one arrives with the analysis beside it: what a defender can still do at that instant.

Synthetic world, no live model and no mail sent. Mechanism and hop structure follow Morris-II (Cohen, Bitton & Nassi, arXiv 2403.02817); the propagation-detector figures are that paper's reported Virtual Donkey results.

Hop 2 is the point. Company B has no relationship with the attacker, their trust in company A was entirely reasonable, and that trust is the delivery mechanism.

Reduces attack rate· expected to degrade

Filtering inbound mail for injections stops hop 0 and nothing after it. From hop 1 onward the payload arrives as ordinary correspondence from a real business contact, so a filter trained on hostile-looking traffic is reading the wrong signal.

The defence that targets replication rather than content

The Morris-II authors also built a guardrail, and it is the interesting one because it does not try to recognise malicious text. It watches for output that reproduces its input, which is the one thing a self-replicating prompt cannot avoid doing.

They report a true-positive rate of 1.0 with a false-positive rate of 0.015, robust against out-of-distribution worms with unseen jailbreaking commands and a different email dataset. Strong numbers, and read them as being about this class of propagation rather than about any payload that rewrites itself on the way through.

2026: the same idea against agent platforms

Morris-II moved between RAG-backed email assistants. The newer work targets agent frameworks directly, where there is more to grab than a retrieval corpus.

the first self-replicating worm attack against a production-scale agent framework, achieving a fully autonomous infection cycle initiated by a single message: the worm first hijacks the victim's core configuration to establish persistent presence across session restarts, then executes an arbitrary payload upon each reboot, and finally propagates itself to every newly encountered peer without further attacker intervention.

Zhang, Wei, Luan et al. · AgentWorm, arXiv 2603.15727

	Morris-II (2024)	AgentWorm (2026)
Host	RAG-backed email assistants	A production agent framework, with over 40,000 active instances reported
Persistence	The retrieval corpus	The agent's core configuration file, surviving session restarts
Trigger	Retrieval on a future query	Every reboot
Reported success	Varies with context size, embedding model and hop count	63% aggregate attack success rate, sustained multi-hop propagation

Both rows quoted or condensed from the papers' own abstracts. Comparison is this course's.

Deep diveTwo results worth carrying into a test plan›

A third 2026 paper (Zha & Wang, arXiv 2605.02812) studies file-backed agent ecosystems, where content written into persistent state re-enters the decision context through scheduled autoloading.

Two of their empirical findings are directly actionable. First, user prompt carriers achieve higher attack compliance than system prompt carriers, so a payload placed where the user's words go outperforms the same payload placed in the system prompt. Second, read operations represent the primary integrity threat, which inverts the usual instinct to concentrate review on writes.

They also demonstrate three-hop cross-platform transmission without platform-specific adaptation, which is the property that makes this a fleet problem rather than a product problem.

What this changes about response

Ordinary incident response assumes the attacker is somewhere. Here they left after hop 0, and every subsequent event is a legitimate system behaving as built.

The practical consequence is that cleanup has to be simultaneous. One poisoned corpus that gets missed re-infects the ones that were cleaned, so a staged rollout of the fix reads as the incident recurring.

Bounds blast radius· survives adaptive attack

Removing automatic processing, or detecting output that reproduces its input. Both act on the mechanism rather than on the phrasing, which is why they survive a payload that gets rewritten. Neither is free: the first costs the zero-click feature the product was sold on.

Sources