Morris II: From Prompt Injection to AI Virology

Abstract

In 2024, Stav Cohen, Ron Bitton, and Ben Nassi published Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications, describing Morris II—a self-replicating prompt capable of triggering a chain of indirect prompt injection across interacting GenAI applications. The authors studied the mechanism in an ecosystem of AI-powered email assistants and examined the effects of context size, embedding models, and propagation hops. They also proposed a defensive mechanism called Virtual Donkey. [1]

The name Morris II references the 1988 Internet Worm, but technically this is not an ordinary network worm. The key novelty lies elsewhere:

the interpretation of data by an AI model itself becomes part of the propagation mechanism for malicious logic.

That transition—from AI as target to AI as propagation substrate—is one of the starting points for the concept of AI virology.

1. Why Morris II Matters

A classical worm can be simplified to:

host
  ↓
vulnerability
  ↓
exploit
  ↓
execution
  ↓
replication
  ↓
next host

In such systems, propagation logic largely resides inside the malware itself.

Morris II introduces a different chain:

external content
      ↓
AI context
      ↓
model interpretation
      ↓
unexpected action
      ↓
new AI context
      ↓
next model interpretation

Malicious logic can therefore move not as an executable file, but as semantic state that the next AI component is capable of interpreting.

OWASP continues to treat prompt injection, including indirect prompt injection, as a fundamental risk in GenAI systems. External documents, websites, and other sources can alter model behavior, with consequences becoming more serious when a model is connected to data, tools, or other systems. [2]

Morris II demonstrates the next logical step:

if attacker-controlled content can influence not just one response but enter the next AI system, a propagation loop becomes possible.

2. What Morris II Actually Demonstrates

The authors’ experimental system was built around GenAI email assistants using retrieval and context mechanisms.

Simplified:

attacker-controlled content
            │
            ▼
     Application A
            │
            │ malicious content enters context
            ▼
      Model A
            │
            │ generated output
            ▼
   Application B / stored context
            │
            ▼
      Model B
            │
            └──────► next victim

The key idea is:

replication does not have to mean copying program bytes.

Instead of:

copy executable → launch executable

we can have:

transmit instruction-capable content → next model interprets it → produce another propagating representation.

This is a fundamentally different mechanism.

3. Why Is It Reasonable to Call This a Worm?

A worm traditionally implies automated propagation between nodes without requiring a human to manually initiate every instance.

Morris II contains an important part of that structure:

replicable representation
        +
reachable next host
        +
automated transfer
        +
new execution context

The term worm is therefore useful.

The critical distinction is the nature of the propagation logic.

Classical worm:

code-mediated propagation

Morris II:

model-mediated propagation

The intermediate interpreter is an AI model.

4. An AI Worm Is More Than a Payload

For AI-native propagation research, it is useful to separate four components.

4.1 Host

The environment in which AI can interpret attacker-controlled content.

Examples include:

• chatbot;
• RAG application;
• email assistant;
• coding agent;
• browser agent;
• personal agent;
• multi-agent environment.

The host in AI virology therefore does not have to be a single machine.

It may be a software ecosystem.

4.2 Propagation Surface

The channel through which malicious state gains a path to the next interpreter.

In Morris II, this is related to inter-application communication and retrieval.

In modern agentic systems, potential propagation surfaces include:

web content
documents
email
RAG corpora
memory
tool outputs
agent messages
shared workspace state
configuration
scheduled tasks
plugins / skills

OWASP separately highlights indirect prompt injection, memory poisoning, tool abuse, and excessive agency as related risks in agentic systems. [2][3]

4.3 Replication

In traditional malware, replication usually means creating a copy of code.

In AI ecosystems, other forms are possible:

instruction replication
context replication
memory replication
configuration replication
message replication
agent-state replication

An AI worm therefore does not necessarily copy itself literally.

It may copy a structure capable of inducing the relevant behavior again.

4.4 Execution

The final component is the action performed by the compromised system.

For a simple GenAI assistant, this may be limited to changing the result of data processing.

For an agentic system, the chain can become:

model
  ↓
tool selection
  ↓
API call
  ↓
external side effect

This is where propagation and agency begin to reinforce each other.

5. RAG as a Propagation Substrate

RAG is usually framed as a mechanism for improving answer quality.

From an AI virology perspective, it can additionally be viewed as a:

transport layer for semantic state

A simplified chain:

external source
      ↓
ingestion
      ↓
storage
      ↓
retrieval
      ↓
context
      ↓
model

If attacker-controlled content can traverse this path, malicious state may:

1. enter the system;
2. be stored;
3. be retrieved;
4. re-enter model context;
5. influence model behavior.

This makes retrieval/context integrity a security boundary.

This should not be overstated: an embedding database is not itself a “viral mechanism.” The risk arises from the combination of:

untrusted source + retrieval + instruction interpretation.

6. The Key Idea: Payload and Interpreter Are Separated

Conventional malware often carries:

payload + execution logic

An AI-mediated attack may look like:

payload
   ↓
AI interpreter
   ↓
generated behavior

The interpreter already exists in the victim’s infrastructure.

This means attacker-controlled content can exploit the existing capability of an AI component to turn language into action.

A useful research framing therefore becomes:

an AI system is not only a target, but also an execution substrate for propagating semantic logic.

7. Why Zero-Click Matters

The important point is not a magical absence of all human interaction. The relevant property is the absence of a separate human action at each propagation step.

Traditional phishing:

attacker → victim → victim action

AI-mediated propagation could look like:

attacker
   ↓
host A
   ↓
AI interpretation
   ↓
host B
   ↓
AI interpretation
   ↓
host C

The human may therefore cease to be the operator of every transition.

8. Limits of the Original Morris II

Morris II did not demonstrate a universal Internet worm capable of compromising arbitrary AI systems.

It was a controlled experimental ecosystem with a specific architecture, specific AI applications, and a specific propagation chain. [1]

A scientifically defensible formulation is therefore:

Morris II is a proof of concept showing that AI-mediated self-propagation is possible under suitable architectural connectivity.

An overclaim would be:

Morris II proved the existence of a universal AI virus.

That distinction is essential for serious analysis.

9. Virtual Donkey and the Detection Problem

The authors of Morris II proposed Virtual Donkey as a defensive mechanism.

In their experiment, it achieved a true-positive rate of 1.0 and a false-positive rate of 0.015, and it was also evaluated against a subset of out-of-distribution scenarios. [1]

These numbers should not be read as evidence for a universal AI-worm detector.

For any detector, at least three questions matter:

What distribution was tested?
What variants were unseen?
How much does the detector depend on the exact propagation mechanism?

Distribution shift is particularly important for AI-native threats. An attacker may change wording, context, carrier, and action chain without changing the underlying objective.

10. From Prompt Worms to Persistent Agent Worms

Morris II primarily demonstrated:

prompt/context propagation

The next stage is associated with persistent AI systems.

A modern agent may have:

• memory;
• persistent workspace;
• scheduled tasks;
• configuration;
• messaging;
• tools.

Malicious state can then survive beyond a single conversation:

malicious content
      ↓
persistent state
      ↓
future session
      ↓
model context
      ↓
action

Recent work on autonomous LLM agent worms explicitly considers persistent workspaces, memory files, and scheduled state as potential propagation surfaces. [4]

This introduces a new kind of propagation:

temporal propagation.

The infection spreads not only through space, but also through time.

11. Memory Worms

This is an especially important direction.

If malicious state affects only the current context, the attack may disappear after a session ends.

If it enters persistent memory:

infection
   ↓
memory
   ↓
future context
   ↓
future action

then the system gains a form of persistence.

AI virology should therefore treat memory integrity not merely as a personalization concern, but as a distinct security boundary.

12. Agent-to-Agent Propagation

The next class emerges in multi-agent systems:

Agent A
   ↕
Agent B
   ↕
Agent C
   ↕
Agent D

If agents exchange messages and accept their contents as part of decision context, inter-agent communication becomes a potential transmission channel.

OWASP explicitly identifies compromised peer agents as a source of risk within agentic systems. [3]

Therefore:

agent-to-agent trust becomes a security boundary.

13. Adaptive Worms: The Next Qualitative Step

In 2026, the paper AI Agents Enable Adaptive Computer Worms examined a substantially stronger threat model.

Here, an AI agent is used to form target-specific attack strategies rather than merely interpret a predefined payload. The authors describe a proof of concept in an isolated 33-host network including Linux, Windows, and IoT-like systems. Across runs, the system reportedly identified 31.3 vulnerabilities on average, obtained elevated access on 23.1 hosts, and propagated to 20.4 hosts; some runs reached seven replication generations. [5]

The authors intentionally withheld some operational details because of the obvious dual-use risk, and the experiments were conducted in an isolated environment. [5]

This is no longer just:

propagate payload

It becomes:

observe
   ↓
reason
   ↓
choose strategy
   ↓
act
   ↓
observe result
   ↓
adapt
   ↓
propagate

The feedback loop is one of the most important characteristics of the next generation of AI-driven threats.

14. AI Worms as Closed-Loop Systems

Classical worm:

scan → exploit → replicate

Adaptive AI worm:

observe
   ↓
reason
   ↓
hypothesize
   ↓
act
   ↓
evaluate
   ↓
adapt
   ↓
replicate

Malware can therefore gain a capability that previously required a human operator:

target-specific adaptation.

This changes not only the speed of attack development, but the architecture of the attacker itself.

15. Compute Parasitism

An even more interesting architecture appears when compromised systems provide compute resources for further reasoning.

A simplified model:

infection
   ↓
compute acquisition
   ↓
new inference capacity
   ↓
more reasoning
   ↓
new infections

The 2026 work describes compromised GPU-equipped hosts as potential reasoning nodes, while less capable devices can use those resources for further activity. [5]

This creates a potential self-sustaining compute architecture.

16. Economic Asymmetry

Traditional targeted intrusion often requires:

human expertise
+
reconnaissance
+
target-specific adaptation

A traditional worm scales, but its exploit repertoire is often fixed.

An adaptive AI worm potentially combines:

worm scalability
+
automated adaptation

The 2026 work frames this as a new economic trade-off: expensive target-specific adaptation and worm-scale propagation can become part of the same system. [5]

For defenders, this may reduce the marginal cost of additional compromises.

17. A Working Anatomy of AI Virology

For VXHEAVEN, I propose the following working model:

                 ┌──────────────┐
                 │     HOST     │
                 └──────┬───────┘
                        │
                        ▼
              ┌─────────────────┐
              │ PROPAGATION     │
              │ SURFACE         │
              └────────┬────────┘
                       │
                       ▼
              ┌─────────────────┐
              │ REPLICATION     │
              └────────┬────────┘
                       │
                       ▼
              ┌─────────────────┐
              │ INTERPRETATION  │
              └────────┬────────┘
                       │
                       ▼
              ┌─────────────────┐
              │ EXECUTION       │
              └────────┬────────┘
                       │
                       ▼
              ┌─────────────────┐
              │ PERSISTENCE     │
              └────────┬────────┘
                       │
                       ▼
              ┌─────────────────┐
              │ ADAPTATION      │
              └────────┬────────┘
                       │
                       └──────► NEXT HOST

This resembles a biological infection model:

host
→ entry
→ replication
→ transmission
→ persistence
→ adaptation

But in AI virology, the host may not be a file. It can be a distributed structure of behavior and state.

18. A Working VXHEAVEN Taxonomy

AI-assisted malware

Traditional malware using AI as an auxiliary tool.

AI-mediated attack

An attack in which AI participates in the decision or execution chain.

AI-native worm

Self-propagation materially depends on AI interpretation, generation, or an agent loop.

Prompt worm

Propagation through attacker-controlled instructions interpreted by subsequent AI systems.

RAG worm

Propagation through retrieval/index/context infrastructure.

Memory worm

Propagation or persistence through AI memory/state.

Agent worm

Propagation through autonomous AI agents.

Adaptive worm

Attack strategy changes according to the target.

Self-sustaining AI worm

Compromised systems provide compute or infrastructure for further reasoning and propagation.

This taxonomy is a working research model, not an accepted industry standard.

19. When Does an Attack Become an “AI Worm”?

An LLM by itself is not a worm.

Prompt injection by itself is not a worm.

Self-propagation requires a combination of:

carrier
+
interpretation mechanism
+
reachable next host
+
reproduction/transmission mechanism

Stronger autonomy adds:

persistent state
+
tools
+
feedback
+
target adaptation

A working progression is:

Prompt Injection
      ↓
Self-Replicating Prompt
      ↓
AI-Mediated Propagation
      ↓
Persistent AI Worm
      ↓
Agent Worm
      ↓
Adaptive AI Worm
      ↓
Self-Sustaining AI Adversary

This is not a strict evolutionary ladder; it is a research model.

20. The Main Defensive Lesson

Defense cannot stop at the model.

It is not enough to say:

“We installed a strong system prompt.”

The entire chain needs protection:

external content
       ↓
trust boundary
       ↓
retrieval
       ↓
model
       ↓
memory
       ↓
tool selection
       ↓
external action

OWASP emphasizes that in agentic systems, prompt injection, tool abuse, privilege escalation, data exfiltration, and memory poisoning form a connected attack surface. [2][3]

21. Least Agency

Software security has the principle of least privilege.

For AI systems, a useful analogue is:

least agency

An agent should receive only the capabilities required for the task.

read
≠
write

write
≠
execute

execute
≠
admin

external data
≠
trusted instruction

The larger the capability graph, the larger the potential blast radius of a successful prompt injection.

22. Data ≠ Instruction

One of the core rules of AI virology is:

external content must not become a trusted instruction merely because it appears in model context.

An idealized architecture is:

DATA
  │
  ▼
untrusted observation
  │
  ▼
policy / authorization
  │
  ▼
MODEL
  │
  ▼
validated action

not:

DATA
  ↓
MODEL
  ↓
ACTION

This may be the simplest formula for explaining much of modern agent security.

23. Detection Alone Is Not Enough

If propagation has multiple independent channels:

RAG
memory
email
tool result
agent message
workspace

blocking one channel does not necessarily stop propagation.

Defensive architecture must therefore limit not only the payload, but also the connectivity graph.

In graph-theoretic terms, an interesting defensive objective is:

minimize reachability from attacker-controlled state to the next trusted execution context.

In other words, make the propagation graph less connected.

24. AI Virology as a Graph Problem

An ecosystem can be represented as:

          Agent A
         /       \
      RAG         Tool
       /            \
  Agent B ---- Memory
      \              /
       Agent C ---- Web

Every edge is a potential propagation channel.

The threat is determined not only by the number of nodes, but also by:

• trust relationships;
• write permissions;
• persistence;
• cross-domain bridges;
• autonomous execution.

This leads to a broader defensive objective:

not merely preventing malicious state from entering a system, but preventing it from gaining a path to the next trusted execution context.

25. What Should We Measure?

Ordinary LLM benchmarks are insufficient for AI worms.

Dedicated metrics are needed.

Propagation depth

How many generations of nodes can malicious state traverse?

Propagation breadth

How many new hosts or agents can one infection affect?

Persistence

Does the state survive:

• restart;
• new session;
• memory compaction;
• model replacement;
• context reset?

Adaptation

Does the strategy change when the target changes?

Agency dependency

Which permissions and tools are required?

Human dependency

How many human actions are required per propagation step?

Detection latency

How much time passes between entry and detection?

Containment radius

How far can the infection spread before it is contained?

26. Why Morris II Is a Beginning, Not an End

Morris II showed:

semantic payload can participate in propagation.

The next stage is:

an agent can adapt propagation strategy.

Persistent-agent research adds:

state can survive an individual session.

Multi-agent systems add:

another AI agent can become a transmission channel.

Together, these produce:

semantic propagation
        +
persistent state
        +
autonomous agency
        +
tool access
        +
network reachability
        +
adaptation

This combination represents one of the most interesting classes of AI-native cyber threats.

27. What We Still Do Not Know

Even with these studies, major questions remain:

• how robust these propagation mechanisms are on the real Internet;
• how effective isolation and capability controls are;
• how propagation changes under model substitution;
• what minimum agent capability is sufficient for self-sustaining propagation;
• how quickly infection can be localized;
• which detection signals remain stable under model and context drift.

This is why controlled experiments and reproducible defensive evaluation matter.

28. VXHEAVEN’s Research Position

VXHEAVEN should not use “AI worm” as a marketing label.

For every claim, ask:

HOST
  ↓
ENTRY
  ↓
PROPAGATION
  ↓
REPLICATION
  ↓
PERSISTENCE
  ↓
ACTION
  ↓
ADAPTATION
  ↓
NEXT HOST

And for every transition:

what observation supports it?

This helps separate a real propagation mechanism from an impressive but non-operational description of LLM behavior.

29. Conclusion

Morris II did not demonstrate “a virus inside ChatGPT.”

It demonstrated something more fundamental:

an AI application can become part of the mechanism by which an attack propagates.

When external content enters context, is interpreted as an instruction, and the resulting output becomes transferable to another AI system, a new propagation surface appears.

In 2024 this was demonstrated at the level of self-replicating prompts.

By 2026, the research line had expanded toward persistent state, multi-agent communication, tool-mediated action, and adaptive AI-driven worms. [4][5]

Therefore, the traditional model:

malware attacks AI

is insufficient.

We need to study:

malware
   ↓
AI system
   ↓
AI interpretation
   ↓
AI action
   ↓
AI-mediated propagation
   ↓
new AI system

The transition from AI as target to AI as propagation substrate is, in our view, a foundational idea of AI virology.

Morris II is one of the studies that made that transition observable.

References

[1] Cohen, S.; Bitton, R.; Nassi, B. Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications. arXiv:2403.02817, 2024. https://arxiv.org/abs/2403.02817

[2] OWASP GenAI Security Project. LLM01:2025 Prompt Injection. https://genai.owasp.org/llm-risk/llm01-prompt-injection/

[3] OWASP. AI Agent Security Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html

[4] Zha, M.; Wang, X. Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense. 2026. https://arxiv.org/abs/2605.02812

[5] Guan, J.; Blanchard, T.; Foerster, H.; Jia, H.; Huang, G.; Papernot, N. AI Agents Enable Adaptive Computer Worms. 2026. https://arxiv.org/abs/2606.03811

[6] Zhang, Y. et al. ClawWorm: Self-Propagating Attacks Across LLM Agent Ecosystems. 2026. https://arxiv.org/abs/2603.15727

Research note

This article intentionally describes threat mechanisms and defensive architecture at a level sufficient for scientific analysis while omitting operational exploit recipes, deployment instructions, and other details that would materially lower the barrier to misuse.