Morris II: The First Zero-Click Worm for GenAI Assistants
A prompt that doesn't just attack one assistant — it copies itself into the emails that assistant sends, and moves on.
| When | March 2024 |
|---|---|
| Target | RAG-backed GenAI email assistants (research setup) |
| Researchers | Cohen, Bitton, Nassi (Technion / Cornell Tech / Intuit) |
| Technique | Adversarial self-replicating prompt (arXiv:2403.02817) |
| Status | Research demonstration — no in-the-wild outbreak |
- 1An infected email is processed by a RAG-backed GenAI email assistant
- 2Indirect injection makes the assistant run a payload and copy the worm into its replies
- 3The reply infects the next assistant, and the worm propagates zero-click
What happened
In 2024, researchers Cohen, Bitton and Nassi unveiled Morris II (paper: 'Here Comes The AI Worm') — the first demonstrated worm targeting GenAI-powered applications. Against experimental RAG-backed email assistants, an adversarial self-replicating prompt spread zero-click: processing one infected email caused the assistant to act maliciously and to reproduce the worm in its own outgoing mail.
How the attack worked
The injected prompt did two things at once: it triggered a payload (spamming, or exfiltrating personal data from the mailbox) and it instructed the assistant to embed the same prompt inside the messages it generated. Each newly-infected assistant then forwarded the payload to the next, so the attack self-propagated across a network of agents. The team showed text and image-embedded variants.
Root cause
Retrieved/received content was treated as instructions, and assistants could send outbound mail autonomously — closing a replicate-and-send loop with no human in it.
Why it matters
As assistants gain autonomy and talk to each other, a single injected message can become self-spreading. It's a proof of concept, not a wild outbreak — but it maps the shape of the threat.
How to prevent it
- Don't let received content act as instructions to the assistant.
- Break the loop with human approval on outbound actions and messages.
- Inspect agent-generated mail for injected/replicating payloads; rate-limit sending.
FAQ
What makes it a 'worm'?
The injected prompt instructs the assistant to reproduce the prompt itself inside the emails it generates. Each newly-infected assistant then forwards the payload onward, so it self-replicates across a network of agents without human action.
Is it a real outbreak?
No — it's a controlled academic demonstration (paper 'Here Comes The AI Worm') against experimental GenAI email assistants, not a worm seen in the wild. It proves the class is viable as assistants gain autonomy and reach.
How do you prevent worming?
Don't let retrieved content act as instructions, break the replicate-and-send loop with human approval on outbound actions, and rate-limit/inspect agent-generated messages for injected payloads.