{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:KN3STL6EMHU3DSWTAPZPAXGZVQ","short_pith_number":"pith:KN3STL6E","canonical_record":{"source":{"id":"2403.02817","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-03-05T09:37:13Z","cross_cats_sorted":[],"title_canon_sha256":"b5685782500a5840cd05769785bfce916bf2c651842aeaf38cbc78bc36c9062c","abstract_canon_sha256":"35d6f7327ba94236c91ce2d9351f9ea50e69e2ca64e4fd24fbd501747f723ea8"},"schema_version":"1.0"},"canonical_sha256":"537729afc461e9b1cad303f2f05cd9ac03946482106cd6205e9e3a37536b6cb8","source":{"kind":"arxiv","id":"2403.02817","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2403.02817","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"arxiv_version","alias_value":"2403.02817v2","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2403.02817","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"pith_short_12","alias_value":"KN3STL6EMHU3","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"pith_short_16","alias_value":"KN3STL6EMHU3DSWT","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"pith_short_8","alias_value":"KN3STL6E","created_at":"2026-07-05T10:07:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:KN3STL6EMHU3DSWTAPZPAXGZVQ","target":"record","payload":{"canonical_record":{"source":{"id":"2403.02817","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-03-05T09:37:13Z","cross_cats_sorted":[],"title_canon_sha256":"b5685782500a5840cd05769785bfce916bf2c651842aeaf38cbc78bc36c9062c","abstract_canon_sha256":"35d6f7327ba94236c91ce2d9351f9ea50e69e2ca64e4fd24fbd501747f723ea8"},"schema_version":"1.0"},"canonical_sha256":"537729afc461e9b1cad303f2f05cd9ac03946482106cd6205e9e3a37536b6cb8","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:07:24.006701Z","signature_b64":"Mz89DMAIqokuxqNESTnAmmS2bAITBfUKUVIQUFObRcbn7vC6Ei26cpi2WYtgoSEqioJhBEP7VyRpm0mAUDw3Cg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"537729afc461e9b1cad303f2f05cd9ac03946482106cd6205e9e3a37536b6cb8","last_reissued_at":"2026-07-05T10:07:24.006248Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:07:24.006248Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2403.02817","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:07:24Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"SjDybyOt1zV5ZT8ZDNnot+g+5YOdtxLOAG43VlJa5lYjn2soM2JSnta3z5Xkbu2nmZIClNn2/b3kxhyJlh/uCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T10:35:50.773286Z"},"content_sha256":"d36e754f1d5d3d51010a9e3ce852844f554ea4cdcce71e64d619b029fd187a70","schema_version":"1.0","event_id":"sha256:d36e754f1d5d3d51010a9e3ce852844f554ea4cdcce71e64d619b029fd187a70"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:KN3STL6EMHU3DSWTAPZPAXGZVQ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Ben Nassi, Ron Bitton, Stav Cohen","submitted_at":"2024-03-05T09:37:13Z","abstract_excerpt":"In this paper, we show that when the communication between GenAI-powered applications relies on RAG-based inference, an attacker can initiate a computer worm-like chain reaction that we call Morris-II. This is done by crafting an adversarial self-replicating prompt that triggers a cascade of indirect prompt injections within the ecosystem and forces each affected application to perform malicious actions and compromise the RAG of additional applications. We evaluate the performance of the worm in creating a chain of confidential user data extraction within a GenAI ecosystem of GenAI-powered ema"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2403.02817","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2403.02817/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T10:07:24Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pBX+0SQMrR2gI/6m+YN7tnlo10OSycapeK+p4yhwxpPsa8/moYip2qdxIdPqFMJ8W1NjnorG/Nzao4DLjjjtBA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-07T10:35:50.774053Z"},"content_sha256":"53b0c198de0d2f45bf6d0b91080aa8560c9fd991061c879490062b3b16041174","schema_version":"1.0","event_id":"sha256:53b0c198de0d2f45bf6d0b91080aa8560c9fd991061c879490062b3b16041174"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/KN3STL6EMHU3DSWTAPZPAXGZVQ/bundle.json","state_url":"https://pith.science/pith/KN3STL6EMHU3DSWTAPZPAXGZVQ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/KN3STL6EMHU3DSWTAPZPAXGZVQ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-07T10:35:50Z","links":{"resolver":"https://pith.science/pith/KN3STL6EMHU3DSWTAPZPAXGZVQ","bundle":"https://pith.science/pith/KN3STL6EMHU3DSWTAPZPAXGZVQ/bundle.json","state":"https://pith.science/pith/KN3STL6EMHU3DSWTAPZPAXGZVQ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/KN3STL6EMHU3DSWTAPZPAXGZVQ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:KN3STL6EMHU3DSWTAPZPAXGZVQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"35d6f7327ba94236c91ce2d9351f9ea50e69e2ca64e4fd24fbd501747f723ea8","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-03-05T09:37:13Z","title_canon_sha256":"b5685782500a5840cd05769785bfce916bf2c651842aeaf38cbc78bc36c9062c"},"schema_version":"1.0","source":{"id":"2403.02817","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2403.02817","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"arxiv_version","alias_value":"2403.02817v2","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2403.02817","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"pith_short_12","alias_value":"KN3STL6EMHU3","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"pith_short_16","alias_value":"KN3STL6EMHU3DSWT","created_at":"2026-07-05T10:07:24Z"},{"alias_kind":"pith_short_8","alias_value":"KN3STL6E","created_at":"2026-07-05T10:07:24Z"}],"graph_snapshots":[{"event_id":"sha256:53b0c198de0d2f45bf6d0b91080aa8560c9fd991061c879490062b3b16041174","target":"graph","created_at":"2026-07-05T10:07:24Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2403.02817/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"In this paper, we show that when the communication between GenAI-powered applications relies on RAG-based inference, an attacker can initiate a computer worm-like chain reaction that we call Morris-II. This is done by crafting an adversarial self-replicating prompt that triggers a cascade of indirect prompt injections within the ecosystem and forces each affected application to perform malicious actions and compromise the RAG of additional applications. We evaluate the performance of the worm in creating a chain of confidential user data extraction within a GenAI ecosystem of GenAI-powered ema","authors_text":"Ben Nassi, Ron Bitton, Stav Cohen","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-03-05T09:37:13Z","title":"Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2403.02817","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:d36e754f1d5d3d51010a9e3ce852844f554ea4cdcce71e64d619b029fd187a70","target":"record","created_at":"2026-07-05T10:07:24Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"35d6f7327ba94236c91ce2d9351f9ea50e69e2ca64e4fd24fbd501747f723ea8","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2024-03-05T09:37:13Z","title_canon_sha256":"b5685782500a5840cd05769785bfce916bf2c651842aeaf38cbc78bc36c9062c"},"schema_version":"1.0","source":{"id":"2403.02817","kind":"arxiv","version":2}},"canonical_sha256":"537729afc461e9b1cad303f2f05cd9ac03946482106cd6205e9e3a37536b6cb8","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"537729afc461e9b1cad303f2f05cd9ac03946482106cd6205e9e3a37536b6cb8","first_computed_at":"2026-07-05T10:07:24.006248Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T10:07:24.006248Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"Mz89DMAIqokuxqNESTnAmmS2bAITBfUKUVIQUFObRcbn7vC6Ei26cpi2WYtgoSEqioJhBEP7VyRpm0mAUDw3Cg==","signature_status":"signed_v1","signed_at":"2026-07-05T10:07:24.006701Z","signed_message":"canonical_sha256_bytes"},"source_id":"2403.02817","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:d36e754f1d5d3d51010a9e3ce852844f554ea4cdcce71e64d619b029fd187a70","sha256:53b0c198de0d2f45bf6d0b91080aa8560c9fd991061c879490062b3b16041174"],"state_sha256":"b9c59c217b4d294978b95a12b619a07919a006e12034c227cffc5ebf250e965d"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"6YK/jvNjZ/p2W9MwACOw9VzMuY8GXK/1DBKhVa7xHedfbijARcTPTTl+iNwdp8+L3TArCFqeRJiYso19BD83CA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-07T10:35:50.779449Z","bundle_sha256":"7416cb12222193a3bf67baed4a51f05327950b2236089962b90267a3f0de32b8"}}