Morris II: A Self-Replicating Worm for GenAI Ecosystems
An adversarial self-replicating prompt spreads between GenAI-powered email assistants: each infected assistant carries out malicious actions and poisons the RAG of the next, propagating agent-to-agent with zero clicks.
What happened
Morris II — named after the 1988 internet worm — is a proof-of-concept self-replicating worm for GenAI ecosystems, introduced by Stav Cohen, Ron Bitton, and Ben Nassi in 2024. Its core is an adversarial self-replicating prompt: content that compels a GenAI model to reproduce the prompt in its own output. When GenAI apps communicate over RAG-based inference (e.g., email assistants that read and answer messages), an infected assistant both performs a malicious action and poisons the RAG of the next application, which then propagates the payload onward.
Demonstrated against GenAI email assistants, it achieved spamming and personal-data exfiltration, in black-box and white-box settings, using both text and image payloads — spreading agent-to-agent with no user clicks.
Why it maps to ATLAS
- AML.T0051.001 — LLM Prompt Injection: Indirect: the payload arrives inside messages the assistant processes.
- AML.T0070 — RAG Poisoning (Persistence): each hop poisons the next application’s retrieval store.
- AML.T0052 — Phishing (Lateral Movement): self-propagating messages spread the worm between users/agents.
- AML.T0086 — Exfiltration via AI Agent Tool Invocation: infected assistants leak data as they spread.
Detection notes
The worm’s signature is self-reference plus propagation: assistant output that reproduces its own instruction payload and re-enters a RAG store, followed by identical injections cascading across mailboxes. Break the loop by stripping instructions before RAG ingestion, requiring human approval before assistants auto-send, and de-duplicating agent-to-agent message flows.
Detection
Log sources
- Email assistant retrieval/RAG context logs
- Outbound mail generated by the assistant
- RAG datastore write/update audit
Signals
- Assistant-generated messages that reproduce their own instruction payload
- Self-referential prompts designed to be re-embedded into RAG
- Cascading identical injections spreading across mailboxes/agents
Mitigations
- Treat retrieved/generated content as untrusted; strip instructions before RAG ingest
- Human approval before assistants auto-send or auto-forward
- Rate-limit and de-duplicate agent-to-agent message propagation