Analysis
What Is Morris II Worm: RAG-Based Attack? Definition
Publication date unknown · Discovered nhimg.org
Page published
Publication date unknown · First observed: 8 Nov 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Morris II-style propagation highlights why defenders must prevent retrieved content from becoming trusted instructions or crossing authorization boundaries in connected AI workflows.
The Morris II Worm glossary entry describes how malicious instructions in retrieved documents can propagate through connected assistants and shared knowledge sources, potentially enabling exfiltration. The entry summarizes defensive controls, including permission-aware retrieval, index isolation, source restrictions, and constrained agent tool use; it presents no new demonstration or incident.