Pith. sign in

REVIEW 5 cited by

Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2403.02817 v2 pith:KN3STL6E submitted 2024-03-05 cs.CR

Stav Cohen , Ron Bitton , Ben Nassi This is my paper
classification cs.CR
keywords wormapplicationsgenai-poweredperformancepromptrateadversarialaffected
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

In this paper, we show that when the communication between GenAI-powered applications relies on RAG-based inference, an attacker can initiate a computer worm-like chain reaction that we call Morris-II. This is done by crafting an adversarial self-replicating prompt that triggers a cascade of indirect prompt injections within the ecosystem and forces each affected application to perform malicious actions and compromise the RAG of additional applications. We evaluate the performance of the worm in creating a chain of confidential user data extraction within a GenAI ecosystem of GenAI-powered email assistants and analyze how the performance of the worm is affected by the size of the context, the adversarial self-replicating prompt used, the type and size of the embedding algorithm employed, and the number of hops in the propagation. Finally, we introduce the Virtual Donkey, a guardrail intended to detect and prevent the propagation of Morris-II with minimal latency, high accuracy, and a low false-positive rate. We evaluate the guardrail's performance and show that it yields a perfect true-positive rate of 1.0 with a false-positive rate of 0.015, and is robust against out-of-distribution worms, consisting of unseen jailbreaking commands, a different email dataset, and various worm usecases.

Discussion (0). Sign in to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Underwriting the Agent Economy: The Blueprint for an AI Insurance Stack

    cs.CY 2026-07 conditional novelty 6.5 of 10

    Affirmative AI-agent insurance with billion-scale limits is achievable by 2030 solely through coordinated industry build-out of an eight-component stack spanning data, CAT models, standards, contracts, underwriting, p...

  2. Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment

    cs.CR 2025-09 conditional novelty 5.0 of 10

    Attacker-controlled tool descriptions and return values can hijack tool invocation in popular LLM coding agents, yielding remote code execution and denial of service.

  3. Technical Requirements for Halting Dangerous AI Activities

    cs.AI 2025-07 conditional novelty 5.0 of 10

    A taxonomy of compute-centric technical interventions, graded by readiness and mapped to five AI governance plans, argues that halting dangerous AI requires substantial control over AI compute.

  4. Securing Agentic AI: From Per-Action Checks to Trajectory Assurance

    cs.AI 2026-08 conditional novelty 3.0 of 10

    A vision paper organizing agentic AI security into eleven research directions, with the thesis that safety requires verifiable trajectory-level behavioral guarantees, not per-action checks.

  5. Prompt Injection 2.0: Hybrid AI Threats

    cs.CR 2025-07 reject novelty 2.0 of 10

    A structured taxonomy of hybrid prompt injection attacks shows how XSS, CSRF, and SQL injection vectors converge with LLM manipulation to bypass traditional controls.

Pith tools