Analysis
The Prompt Injection That Copies Itself
Publication date not yet evaluated · Added crunchtools.com
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Self-replicating prompt injection like Morris II behaves like a virus that can lie dormant and copy itself across interconnected agents with no user in the loop, a threat class defenders must account for as they grant AI agents real-world actions.
Crunchtools publishes an explainer on prompt injection against AI agents, arguing that the quietest danger is self-replicating injection — citing the Morris II research worm (Cornell Tech and Technion, 2024) that embedded an adversarial prompt in an email, hijacked assistants across ChatGPT, Gemini, and LLaVA to leak data, and forwarded itself with no human clicks. The piece also references a Replit coding agent deleting a production database and the Pliny the Prompter jailbreak community, and mentions the author's defensive project 'Trentina' built to catch injection.