Analysis · curated 20 Sep 2026
Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications
First reported arxiv.org
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Morris II establishes that AI models themselves can become a propagation substrate for self-replicating malicious instructions across interconnected agentic systems, a threat class defenders of RAG and multi-agent deployments must anticipate.
An analysis article on VXHEAVEN examines Morris II, the self-replicating prompt-injection worm presented by Cohen, Bitton, and Nassi in their 2024 paper 'Here Comes The AI Worm,' which demonstrated a zero-click chain reaction of indirect prompt injection across RAG-based GenAI email assistants. The piece dissects the Morris II threat model, contrasts model-mediated propagation with classical code-mediated worms, and discusses the evolution toward persistent-memory, tool-using, and multi-agent 'AI virology' threats, referencing the authors' Virtual Donkey guardrail defense.