Agent Worms: The Reproduction of Delegated Control

From an affected agent to a reproducing lineage

An agent reads a shared artifact, changes its behavior, and produces material that affects another agent. Alternatively, it starts a new agent process that continues the same unauthorized activity. In both cases, the critical transition is from an affected system to a participant in further propagation.

For AI virology, agent worms connect reproduction to delegated control: the tools, identities, persistent state, and execution loops through which agents act. A model can remain unchanged while the surrounding system becomes a carrier. A descendant can also exist as a new process while still depending on the parent’s inference service.

These distinctions make the category useful for infrastructure analysis. Investigators need to know what is inherited, which application boundary has been crossed, and whether the descendant can continue the lineage. Counting suspicious messages or running processes alone cannot answer those questions.

Technical definition and scope

An agent worm is an unauthorized self-propagating process in which an agent’s execution loop participates in establishing further reproduction-capable agent instances, either by influencing existing instances or by creating new runtimes.

This is a proposed VXHEAVEN taxonomy definition. It covers two branches:

• Propagation of control state: an existing agent acquires instructions or state that cause it to participate in further propagation. Its software and model weights may remain unchanged.
• Replication of an agent runtime: a new functioning agent instance inherits enough software, state, access, and inference connectivity to continue the unauthorized process.

The word agent identifies the system that participates in reproduction. It does not imply consciousness, an intrinsic desire to survive, or independence from external infrastructure. Nor does an attacker have to supply a new command for every hop: routine authorized tasks may provide opportunities for an already affected agent to propagate.

A one-time agent hijack is not sufficient. Neither is an authorized deployment controller scaling a service, an agent merely writing malware source code, or a conventional worm whose only AI involvement occurred during development. The agent loop must contribute to the propagation mechanism itself.

A separate damaging payload is optional under this definition. Unauthorized reproduction is already a security deviation. Persistence can increase the period during which an agent remains a carrier, but a transient agent can also propagate before its session ends.

Research evidence and its limits

Zhang et al.’s AgentWorm evaluates OpenClaw 2026.3.12 using isolated instances and simulated channel relays. Across 2,250 trials with five model backends, it reports 63% aggregate success, requiring persistence, payload execution, and payload-bearing output. Separate experiments test multi-hop propagation. Initial seeding is scripted; some conditions include preinstalled skill packages. The experiment therefore distinguishes autonomous downstream behavior from supplied initial conditions. It is not a public-network outbreak. Execution restrictions could suppress payloads while leaving propagation possible. AgentWorm, version 3.

Guan et al.’s AI Agents Enable Adaptive Computer Worms examines another branch: agents that compromise hosts and launch replicas in a contained network. Its main propagation experiments use a shared inference pool, with descendants’ reasoning requests relayed through their parent chain. Local inference deployment is evaluated separately, with target credentials supplied to isolate that task. Thus, process reproduction and independent inference deployment are distinct experimental results. Guan et al., version 1, including Appendices C.2 and C.3.

Two related sources establish the semantic carrier mechanism. Morris II evaluates adversarial self-replicating prompts in a RAG-based email-assistant ecosystem. OpenAI’s September 2026 report describes self-replicating injections in training and evaluation and explicitly reports no observed impact outside simulated tool calls. Neither result should be converted into a general claim about the infection rate of deployed agents. Morris II, OpenAI research report.

Taken together, these studies support examining agent-mediated reproduction as a practical security problem. The broader classification below separates mechanisms that individual experiments measure under different conditions.

What belongs to an agent instance

A useful unit is an application instance with identifiable state, an execution context, and an authorization boundary. It need not correspond to a physical computer. Several isolated agents may share one machine, while a single logical agent may use multiple workers.

For analysis, describe an instance through its behavioral configuration, persistent memory, workspace, inference source, tool interfaces, and effective credentials. These components answer different questions. Configuration can direct behavior; credentials determine which downstream operations a service accepts; the inference source supplies model computation.

Changing a natural-language configuration does not automatically create an operating-system privilege. It can nevertheless redirect privileges that the agent already holds. Conversely, restricting shell execution does not necessarily restrict message delivery, shared-document writes, or changes made through a separate file API.

The definition of an instance should follow the investigation. For cross-tenant spread, tenant identities and separate stores may be the important boundary. For runtime replication, independently scheduled processes may matter. A session restart within the same affected instance is persistence, not automatically a new infection.

Consider a hypothetical engineering workflow. A planning agent reads external material, a coding agent consumes its task notes, and a review agent reads the resulting changes. The mere flow of information is normal. An agent-worm hypothesis requires evidence that an unauthorized influence caused one participant to establish a reproduction-capable state in another. A shared poisoned template independently loaded by all three is a common-source incident unless affected agents contribute a causal reproduction step.

Formal model of behavior and authorization

Let \(S_i(t)\) contain instance \(i\)’s behavioral configuration, memory, and workspace at time \(t\). Let \(q\) be its authorized task and \(c\) an admitted external carrier. The model configuration and inference route are denoted by \(\Theta_i\). A compact application transition is:

$$ \begin{aligned} (y_i,a_i) &\sim F_{\Theta_i}\bigl(\cdot \mid \operatorname{Assemble}(q,c,S_i(t))\bigr), \\ (\bar{y}_i,\bar{a}_i) &= \operatorname{Gate}_{\Pi_i}\bigl(y_i,a_i;\operatorname{AuthContext}_i\bigr), \\ \bigl(S_i(t+1),O_i\bigr) &= \operatorname{Apply}\bigl(S_i(t),\bar{y}_i,\bar{a}_i\bigr). \end{aligned} $$

Here, \(y_i\) is generated content, \(a_i\) is a proposed action set, and the barred terms are the content and actions admitted by application controls. The gate represents all relevant output and tool checks; in a vulnerable implementation, these may be incomplete or absent. \(O_i\) records resulting artifacts, messages, or runtime instances. The authenticated context identifies the requesting principal and granted task scope; it must not be reconstructed solely from claims inside the carrier.

The policy \(\Pi_i\) denotes external authorization constraints, not merely instructions that the model is asked to obey. This distinction makes two failures visible: the agent may propose an unauthorized action, and the application may permit it. Either can be investigated without treating a model’s natural-language explanation as proof of what occurred.

An output becomes a candidate descendant when it carries the mechanism into another processing context or constitutes a new runtime. Establishment requires observable downstream behavior. A newly written file, a successful send, or a live process is an intermediate result; continuation of the reproductive capability needs its own test.

Two lifecycle branches

Both branches begin with an opportunity for unauthorized influence and end with a descendant capable of participating in another cycle. Their intermediate states differ:

Unauthorized influence on an agent
                 |
        +--------+---------+
        |                  |
        v                  v
Transfer of control    Creation of a new
state or a carrier     agent runtime
        |                  |
        v                  v
Existing recipient     Runtime obtains usable
adopts the mechanism   state and inference
        |                  |
        +--------+---------+
                 |
                 v
Descendant continues the unauthorized lineage

In the first branch, the reproduction unit is the change established in a recipient. Stored instructions may reactivate in later sessions, but a memory write without further reproduction is persistent poisoning. In the second branch, a copied agent directory may never become a working descendant. Startup, usable inference, and continuation must be distinguished from file transfer.

The branches can combine. An affected existing agent might create a new runtime; that runtime might distribute instructions to other existing agents. A case record should identify each transition rather than assign one label to the entire incident and discard the rest.

Transport also matters. If an independent supervisor or a human moves every artifact to the next recipient, the experiment measures propagation under that transport arrangement. It does not establish that the agent autonomously discovered, selected, and contacted those recipients.

Relationship to the existing taxonomy

Agent Worms describes the role of the agent system in reproduction. Prompt, RAG, and Memory Worms describe the instruction mechanism and its delivery or persistence pathway. These categories can overlap without becoming synonyms.

A useful case description therefore combines labels with evidence: what crossed the boundary, how it was admitted, which permission enabled the transition, and what the recipient subsequently did. A mere list of affected frameworks is less informative than this causal record.

Inference dependencies and autonomy

The propagation graph records who establishes descendants. The inference-dependency graph records who supplies their reasoning. These graphs can have very different structures.

Many agent processes can share one model endpoint. Their number may grow while their ability to reason remains dependent on a single service. A distributed inference group presents the opposite counting problem: multiple hosts may jointly support only one functioning model service.

For each descendant, record whether inference is externally served, supplied through a parent, or available from resources assigned to the descendant. Test independence relative to a named dependency and a declared function. Surviving removal of the parent process, for example, is different from surviving loss of the external model endpoint.

Autonomy should likewise be decomposed. Automatic carrier generation, automatic delivery, autonomous runtime creation, persistence across restarts, and independent inference are separate properties. Demonstrating one does not establish all the others. A credible assessment states which transitions require the attacker, a user, or an experimental supervisor.

Measuring establishment and reproduction

Track at least four outcomes separately: behavioral redirection, persistence, harmful-action execution, and viable descendant establishment. Their separation matters operationally: a blocked damaging action can coexist with continued carrier production, while a persistent but isolated agent may produce no descendants.

For parent instance \(i\), define \(N_i^k(H;\mathcal{B})\) as its attributed number of new viable descendants of type \(k\), within horizon \(H\) and a declared boundary specification \(\mathcal{B}\). We propose reporting:

$$ R_{\mathrm{AI}}^k(H;\mathcal{B}) =\mathbb{E}_i\left[N_i^k(H;\mathcal{B})\right], \qquad k\in\{\mathrm{state},\mathrm{runtime}\}. $$

For the state branch, a descendant is a previously unaffected existing instance that acquires and demonstrates the reproductive capability. For the runtime branch, it is a new functioning instance that demonstrates that capability. Count a new runtime under the runtime branch, rather than also counting its inherited configuration as a second state descendant.

The boundary specification must identify the application unit, accessible stores, inference dependencies, and test for viability. A candidate that only contains suspicious text or completes an ordinary task has not yet demonstrated reproductive viability. Safe continuation tests can establish a narrower, explicitly bounded claim.

Do not add the two metrics indiscriminately. An existing tenant agent and a new worker process are not necessarily equivalent units. Where a unified population is justified, define it before aggregating. For shared-parent events, apply a consistent attribution rule so that the same descendant is not credited in full to several parents.

Include parents with no offspring, failed starts, observation censoring, and time to establishment. Report persistence duration separately from generation depth. Repeated exposure to one source or repeated sessions in one affected instance must not inflate the descendant count.

These are finite-horizon measurements. Treating them as epidemic thresholds requires additional assumptions about susceptible populations, removal, generation intervals, and correlated failures. A benchmark success rate multiplied by a presumed contact count is a scenario calculation, not a measured reproduction number for production infrastructure.

Defensive architecture and recovery

OWASP describes excessive agency in terms of unnecessary functionality, permissions, and autonomy, and recommends enforcing authorization in downstream systems rather than delegating it to the model. That provides a baseline for containing agent actions. OWASP LLM06:2025.

For agent-worm defense, the taxonomy suggests three additional questions: can task content become future instructions, can an affected agent establish descendants, and can surviving state restore the mechanism after apparent cleanup?

Separate task execution from control-state administration. An agent performing a document task should not thereby acquire permission to redefine its future operating rules. Configuration and durable instruction updates should use a distinct, authenticated authorization path. If the application supports self-editing, the external policy should define which fields and effects are permitted.

Preserve provenance through collaboration. Authentication of a peer establishes its identity, not authority over another agent’s configuration. Summaries and handoffs should retain their origin and scope. A statement that approval occurred earlier is evidence to verify, not a replacement for an actual authorization record.

Enforce boundaries across every available interface. Protecting one tool is insufficient if another interface can perform the same sensitive write or export. Workspace isolation must be checked against shared mounts, memory services, and remote connectors. A disposable local filesystem does not make a persistent cloud write disposable.

Control runtime creation as an infrastructure operation. New instances should have recorded ownership, limited credentials, bounded resources, and an authorized deployment source. Keep their identities and inheritance relationships observable. An agent’s generated plan should not itself grant permission to create another privileged agent.

Recovery must cover both state and descendants. Investigators should identify affected stores, generated artifacts, active runtimes, and credentials whose exposure is established or reasonably suspected. Restore approved configuration and remove unauthorized instances while preserving necessary evidence. Then test whether ordinary authorized processing reintroduces the affected state from a surviving source.

This is why disappearance of the immediate symptom is a weak cleanup criterion. A runtime may stop while a shared instruction artifact remains; a memory entry may be removed while an active descendant can recreate it. Recovery is complete only relative to a declared inventory and observation window.

Safe evaluation in a controlled environment

AgentDojo provides a research framework for evaluating tool-using agents over untrusted data. It is useful background for separating legitimate task performance from adversarial outcomes, but a prompt-injection benchmark result alone does not establish reproduction. Debenedetti et al..

An agent-worm evaluation should add explicit lineage tracking within an isolated, allowlisted environment. Use synthetic identities and data, local communication substitutes, capped resources, and an external supervisor that can stop all test instances. Keep payload effects harmless and observable. No public recipient discovery, live credentials, or unrestricted instance creation is needed to test the distinctions above.

For control-state propagation, independently observe the recipient’s state before and after exposure, then test a bounded continuation in a fresh context. For runtime reproduction, verify the new instance’s actual startup, inference source, and permitted continuation behavior. If the supervisor creates the process or transports the artifact, record that assistance alongside the result.

Matched controls should include benign peer messages, approved configuration changes, ordinary document quotations, and unaffected instances using the same inference backend. These distinguish unauthorized reproduction from expected synchronization, deployment, and shared-service behavior.

Use independent observations of writes, deliveries, process state, and service requests. An agent’s claim that it infected another instance is not ground truth. Record model versions, framework versions, tool policies, retry budgets, and manual interventions. Report legitimate task completion as well as propagation outcomes, so that disabling all useful behavior is not mistaken for a practical defense.

The unit of reproduction determines the claim

Agent worms belong in AI virology because an affected agent can supply the authority and execution needed to establish further reproduction-capable instances. The inherited object may be an instruction-bearing state, a working runtime, or a combination of both.

A precise case report identifies that object, the receiving boundary, the evidence of continuation, and the dependencies that keep the descendant functioning. This supports a taxonomy that distinguishes agent hijacking, persistent poisoning, semantic propagation, and runtime replication while still describing how they combine in one incident.

References

1. Yihao Zhang et al. AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems. arXiv:2603.15727, version 3, July 16, 2026.
2. Jonas Guan et al. AI Agents Enable Adaptive Computer Worms. arXiv:2606.03811, version 1, June 2, 2026.
3. Stav Cohen, Ron Bitton, and Ben Nassi. Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications. arXiv:2403.02817, first submitted 2024; version 2, January 30, 2025.
4. OpenAI. Self-replicating prompt injections exist. September 25, 2026; accessed October 15, 2026.
5. OWASP Gen AI Security Project. LLM06:2025 Excessive Agency. Accessed October 15, 2026.
6. Edoardo Debenedetti et al. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. arXiv:2406.13352, 2024.