Morris II: researchers demonstrate a zero-click worm that propagates between GenAI agents via self-replicating prompts
Cornell Tech / Technion (research) · Mar 5, 2024 · General agent
What happened
Researchers published a paper (arXiv:2403.02817, submitted March 5, 2024) demonstrating an AI worm dubbed 'Morris II', after the 1988 Morris worm. Crafted as an adversarial self-replicating prompt, it exploits RAG-based GenAI applications — demonstrated against Gemini Pro, GPT-4 and LLaVA — to trigger a chain of indirect prompt injections that spread the payload to other agents with zero clicks, using email-assistant spam and data-exfiltration as the demonstrated use cases.
Causal vector
Adversarial self-replicating prompt injected via RAG — worm-like propagation between connected GenAI agents
Source
Reported by arXiv (Cornell Tech / Technion). Verified against the primary report.
A worm that spreads by making agents exfiltrate data is stopped by the same control as every exfil chain: outbound network calls from the agent must pass an allowlist enforced outside the model. Worm-infected or not, an agent whose egress is policy-gated cannot beacon an attacker's server.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Google's Antigravity IDE vulnerable to data exfiltration and remote code execution via prompt injection
Google · Nov 25, 2025
State-sponsored group automates ~80–90% of a cyber-espionage operation using Claude Code and MCP tools
Anthropic (Claude Code, abused by a threat actor) · Nov 1, 2025
Windsurf Cascade coding agent leaks developer secrets via indirect prompt injection
Windsurf (Cascade) · Aug 21, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.