RAG Worms: Retrieval-Augmented Knowledge as a Propagation Substrate

Abstract

Retrieval-augmented generation connects language-model behavior to external knowledge stores. When generated artifacts are subsequently indexed, that connection can become a feedback loop: retrieved content influences an application, the application creates a descendant artifact, and a later retrieval reactivates the same adversarial behavior. This article uses RAG worm as a proposed taxonomy label for such retrieval-mediated, self-propagating processes. The defining property is the production of a viable descendant carrier, rather than contamination of a knowledge base alone.

The article develops a formal model of exposure, activation, semantic replication, and establishment; distinguishes local recurrence from spread between application instances; and proposes an effective reproduction metric, (R_{\mathrm{AI}}). It also examines hybrid pathways through agent memory, defensive trust boundaries, and safe evaluation using isolated systems and harmless outcomes. The taxonomy and equations are analytical proposals, not standardized terminology or measurements of prevalence. No new experimental results are claimed.

1. Scope and evidence

The term RAG worm identifies a propagation mechanism, not a particular executable format, model family, or storage product. The carrier may be ordinary text. The application supplies the interpreter, retrieval infrastructure, permissions, and communication paths that make propagation possible. A vector database is neither necessary nor sufficient: lexical, hybrid, and graph-based retrieval can also participate in the same causal structure.

Three research results provide distinct foundations:

These distinctions follow the different research objectives of Morris II, PoisonedRAG, and AgentPoison. Their attack-success measures should not be treated as interchangeable propagation rates.

Morris II is direct prior evidence for the feasibility of RAG-mediated propagation under its evaluated conditions. PoisonedRAG and AgentPoison establish related corruption mechanisms. Extending these findings into the taxonomy, hybrid pathways, and reproduction model below is this article’s synthesis; it is not a claim that all three papers evaluate the same worm class.

2. Technical definition and classification boundary

A RAG worm is an adversarial process in which retrieved external state causes an AI application to produce or transform a carrier that becomes available to a subsequent retrieval-and-generation cycle and retains the capacity to induce further carrier production.

This definition requires four properties:

1. Retrieval-mediated exposure. A carrier, or a relevant portion of it, reaches the model through a retrieval pipeline.
2. Adversarial behavioral influence. The content causes a deviation from the authorized task or trust policy, beyond ordinary use as evidence.
3. Causal reproduction. That influence causes the application to create or transform a descendant carrier through available output or write mechanisms.
4. Descendant viability. The descendant can re-enter a relevant processing cycle and reproduce the behavioral capability under specified conditions.

Actual observation of a descendant creating a further descendant is stronger evidence than merely identifying text that appears capable of replication. A study should distinguish candidate carrier, demonstrated replication, and demonstrated multigeneration propagation.

No operating-system compromise, model-weight modification, or executable binary is required by the definition. Nor does it imply that every affected application is fully controlled. The observed deviation may be narrow and conditional.

RAG poisoning versus a RAG worm

A poisoned document retrieved repeatedly is persistent poisoning, even if it affects many users. A backup service mirroring that document is ordinary data distribution unless adversarially induced application behavior supplies a reproduction step. A model quoting suspicious text for analysis is not sufficient evidence of activation or replication.

An output containing an incorrect claim may contaminate later answers. That is information contamination; it becomes a worm under this definition only if the descendant retains the capacity to drive further adversarial carrier production. This boundary avoids classifying every hallucination feedback loop as malware.

3. System and threat model

Let application instance (i), at time (t), have state

$$ S_i(t)=\bigl(K_i(t),M_i(t),\Pi_i,\Theta_i,\mathcal{T}_i\bigr). $$

Here, (K_i) is its retrievable knowledge corpus; (M_i) is persistent agent memory; (\Pi_i) is its authorization and trust policy; (\Theta_i) contains model and retrieval configuration; and (\mathcal{T}_i) is the set of available tools and output destinations. A host means an application instance with a defined state and security boundary, not necessarily a separate machine or model.

For query (q), define

$$ \begin{aligned} V_i(q,t) &= \operatorname{Select}{\Pi_i,\Theta_i}\bigl(q,K_i(t)\bigr), \ C_i(q,t) &= \operatorname{Assemble}\bigl(q,V_i(q,t),M_i(t),\Pi_i\bigr), \ (y_i,u_i) &\sim F{\Theta_i}\bigl(\cdot\mid C_i(q,t)\bigr), \ \bar{u}i &= \operatorname{Gate}{\Pi_i}\bigl(u_i,\text{authenticated task context}\bigr), \ (K_i(t+1),M_i(t+1)) &= \operatorname{Update}\bigl(S_i(t),y_i,\bar{u}_i\bigr). \end{aligned} $$

Selection includes permission filtering, retrieval, reranking, deduplication, and context-budget decisions. The sampled output (y_i) and proposed actions (u_i) are distinct from the actions (\bar{u}_i) permitted by an external gate. Updates occur only where the application’s workflow actually stores or exports outputs; generation does not imply persistence.

Let (G_t=(\mathcal{A},\mathcal{E}_t)) describe the application network. An edge (i\to j) exists when an artifact produced by (i) can reach a source consumed by (j). This may involve a shared repository, messaging workflow, or ingestion connector. An edge represents a possible data path, not successful exploitation or authorized access to everything at the destination.

The minimal adversary can introduce or modify some lower-trust content consumed by at least one ingestion process. Stronger access—such as direct index modification, control of memory writes, or knowledge of internal retrieval configuration—must be stated separately. The model does not assume control of the system prompt, the authorization gate, or all destination stores.

Two boundaries are especially consequential: external evidence becoming behavioral authority, and model-produced material becoming durable knowledge or memory. A read-only answering service can be poisoned; a propagation claim additionally requires a path from its outputs into future processing, including any external application that performs that ingestion.

4. Lifecycle

Candidate source
      |
      v
Ingestion and indexing -> dormant availability
      |
      v
Retrieval and context admission
      |
      v
Behavioral activation
      |
      v
Descendant carrier production
      |
      v
Export or persistent write -> downstream admission
      |
      v
New retrieval cycle -> descendant viability test

Admission. A source passes through parsing, chunking, metadata assignment, and indexing. At this stage, a stored candidate may never be retrieved and may be inert after transformation.

Exposure. Relevant carrier content survives the whole selection pipeline and enters the context actually consumed by the model. A vector-search hit discarded by a reranker is not model exposure.

Activation. The application deviates from its authorized task because of the retrieved carrier. Retrieval alone is not activation; a safe answer may explicitly discuss the content without following it.

Reproduction. Activated behavior produces an artifact with the relevant behavioral capability. This might be a reformulated passage rather than a literal copy. Normal task output without that capability is not a descendant infection.

Establishment. The descendant is accepted into a destination where it remains accessible for future processing. Generation, export, ingestion, and continued availability are separate observations.

Reactivation or extinction. Later queries may activate the descendant, or the lineage may terminate because of semantic loss, nonretrieval, rejection, deletion, or lack of further write paths. Dormancy and observation-window censoring must not be mistaken for extinction.

5. Taxonomy

Within the proposed VXHEAVEN classification, the conceptual placement is:

AI Virology
└── AI-Native Propagation
    ├── Prompt Worms
    ├── RAG Worms
    └── Memory Worms

These labels overlap. Prompt worm describes a behavioral mechanism, RAG worm identifies retrieval as a propagation substrate, and memory worm emphasizes durable agent state. They are analytical facets rather than mutually exclusive biological species.

Distributed carriers and some hybrid arrangements are model possibilities, not claims of established deployment. A classification record should also state the model version, permissions, source access, and observation window. Without those conditions, a subtype label says little about practical reach.

6. Semantic replication

Byte equality is an incomplete replication criterion. Parsing, summarization, translation, or memory consolidation may change wording while preserving behavior. Conversely, a near-identical quotation may become inert because the application correctly treats it as evidence.

Let (d) be a parent carrier and (d’) a candidate descendant. Let (\mathcal{Q}) be a declared query distribution and (\mathcal{E}) a fixed evaluation environment. Define a viability predicate

$$ \nu_{\mathcal{E},\mathcal{Q},\tau}(d’)= \mathbf{1}\left[ \Pr\bigl(B_{\mathrm{rep}}\mid d’,\mathcal{E},q\sim\mathcal{Q}\bigr)\geq\tau \right], $$

where (B_{\mathrm{rep}}) is a predeclared behavioral outcome: activation that produces another carrier with the tested reproduction capability. The threshold (\tau) is an evaluation convention, not a natural constant. In a finite experiment, this predicate must be estimated with an operational rubric, bounded descendant replay, and uncertainty intervals; it is not a proof of indefinite reproduction.

Record (d\rightsquigarrow d’) only when logs establish derivation, controlled comparisons support adversarial causation, and (d’) passes the specified viability test. This is a directional lineage relation, not mathematical equivalence.

Embedding similarity can help cluster candidates, but it cannot establish behavioral viability. A defensive explanation of a worm may be semantically similar to a carrier while producing no unauthorized behavior. An identifier copied between artifacts establishes data movement, not necessarily adversarial instruction inheritance.

The practical unit of analysis is therefore causal lineage plus tested capability. For each transition, retain the parent identity, transformation, destination admission event, and independent descendant test result.

7. Retrieval probability and conditional activation

For carrier (d), let (\mathcal{C}(d)) be its derived chunks. Define effective exposure probability as

$$ p_{\mathrm{exp}}(d;i,t)= \mathbb{E}{q\sim\mathcal{Q}{i,t},,\omega} \left[ \mathbf{1}\left{ \operatorname{SufficientExposure}\bigl(\mathcal{C}(d),V_i(q,t;\omega)\bigr) \right} \right], $$

where (\omega) covers pipeline randomness. The exposure predicate specifies which content must survive to support the tested behavior. A single chunk may suffice; a fragmented carrier may require a combination. Document-level retrieval statistics can obscure that distinction.

Measure raw candidate recall, post-reranking inclusion, and final context exposure separately. The estimate depends on query frequency, competing documents, chunk boundaries, permissions, deduplication, freshness, context limits, and retrieval configuration. Similarity scores are ranking signals, not calibrated probabilities of exposure or activation.

For a designated parent-to-child transition, define events (E) (exposure), (A) (activation), (C) (child production), (I) (destination admission), and (V) (child viability). The chain rule gives

$$ \begin{aligned} p_{\mathrm{transition}} ={}&\Pr(E)\Pr(A\mid E)\Pr(C\mid E,A)\ &\times\Pr(I\mid E,A,C)\Pr(V\mid E,A,C,I). \end{aligned} $$

All terms are conditional on the stated system, workload, parent, and observation horizon. This factorization does not assume independence. Multiplying unconditional success rates from unrelated experiments would not estimate this quantity.

Repeated retrieval also requires care. Under the restrictive assumption of independent, identically distributed opportunities with exposure probability (p), the probability of at least one exposure in (n) opportunities is

$$ 1-(1-p)^n. $$

Real workloads frequently violate this assumption through repeated queries, shared caches, correlated users, and evolving corpora. Empirical replay should preserve these dependencies when they matter.

8. An R_AI-style reproduction metric

This article proposes (R_{\mathrm{AI}}) as an effective reproduction measure for a specified application population and workload. It is an analogy to branching-process reproduction, not a metric reported by the cited poisoning papers or an established AI-security standard.

For parent host (i), let (Z_{ij}(H)=1) when that host causally establishes a viable descendant lineage in a previously unaffected host (j) during horizon (H), and zero otherwise. Define

$$ R_{\mathrm{AI}}^{\mathrm{host}}(H) =\mathbb{E}{i}\left[\sum{j\ne i}Z_{ij}(H)\right]. $$

The parent cohort and destination population must be specified. Count a destination once, even if it receives many carriers. Where multiple parents contribute, use a declared attribution rule or report unresolved attribution; do not credit every parent with the entire event.

For a fully observed cohort of (m) parent hosts, an empirical estimate is

$$ \widehat{R}{\mathrm{AI}}^{\mathrm{host}}(H) =\frac{1}{m}\sum{i=1}^{m}n_i(H), $$

where (n_i(H)) is the attributed number of newly affected hosts with viable descendant lineages. Parents with zero offspring remain in the denominator. Account for incomplete follow-up rather than treating unobserved offspring as absent.

A separate carrier-level measure is useful:

$$ R_{\mathrm{AI}}^{\mathrm{carrier}}(H) =\mathbb{E}[\text{distinct viable child carriers per parent carrier within }H]. $$

Carrier reproduction can exceed one inside a single isolated application while host reproduction remains zero. Likewise, a shared corpus can expose many hosts without any host generating a new carrier. Neither carrier counts nor exposure counts alone establish inter-host reproduction.

As an illustrative calculation, suppose each parent has five distinct susceptible destinations, each with an overall establishment probability of 0.12 under the evaluated conditions. Expected host reproduction is (5\times0.12=0.6). Linearity of expectation permits this calculation without independence between destinations, provided each marginal probability is valid and destinations are counted once. These are hypothetical values, not empirical findings.

For interpretation, values above one indicate expected early expansion only under branching-like conditions: sufficiently many susceptible hosts, stable transition behavior, a suitable generation interval, and limited interference between lineages. A finite-window estimate depends on (H); it is not automatically a lifetime reproduction number. Finite networks, cleanup, workload changes, and shared dependencies can invalidate a simple threshold interpretation. Below one does not mean zero impact: even a nonexpanding chain may cause serious local harm.

Report generation time alongside reproduction. Two systems with equal expected offspring but very different ingestion delays have different propagation speed and opportunities for containment.

9. Hybrid RAG–Memory propagation

RAG knowledge and agent memory can occupy different trust roles even when they use the same storage technology. Knowledge is typically evidence about an external domain; memory may encode past interactions, preferences, or task experience. A hybrid pathway exists when content moves between those roles:

Retrieved knowledge -> agent interpretation -> persistent memory
Persistent memory -> later output -> retrievable knowledge

The risk is a change in authority as well as location. A retrieved assertion may become a stored preference or procedural recollection, then influence later output as if it were established agent experience. This pathway is a proposed extension of the propagation model. AgentPoison motivates examining both memory and knowledge stores, but does not by itself validate this complete cross-store reproductive loop. See AgentPoison.

For carrier-level analysis, let (R) denote a carrier in retrievable knowledge and (M) a carrier in persistent agent memory. Define the next-generation matrix

$$ \mathbf{B}= \begin{pmatrix} b_{RR} & b_{RM} \ b_{MR} & b_{MM} \end{pmatrix}, \qquad b_{ab}=\mathbb{E}[\text{viable type-}a\text{ children from one type-}b\text{ parent}]. $$

Rows represent child type; columns represent parent type. Thus (b_{MR}) measures RAG-to-memory reproduction, while (b_{RM}) measures memory-to-RAG reproduction. Under a stationary multitype branching approximation,

$$ \mathbb{E}[\mathbf{x}_{g+1}\mid\mathbf{x}_g]=\mathbf{B}\mathbf{x}g, \qquad R{\mathrm{AI}}^{\mathrm{hybrid}}=\rho(\mathbf{B}), $$

where (\rho) is the spectral radius. This is a carrier-level growth criterion; it is not interchangeable with host reproduction. Every child counted here must be a newly established viable carrier, rather than a parent surviving into the next observation period. If an existing object merely changes type, use a state-transition model instead of counting that change as reproductive offspring.

For illustration,

$$ \mathbf{B}= \begin{pmatrix} 0.4 & 0.8 \ 0.8 & 0.4 \end{pmatrix} \quad\Longrightarrow\quad \rho(\mathbf{B})=1.2. $$

Both within-store reproduction terms are below one, yet cross-store pathways make the hypothetical coupled process supercritical. The values are not measurements. The example explains why an evaluation that disables memory may miss a feedback path present in the complete application.

Memory and corpus cleanup must therefore be evaluated together. A deleted source may leave derived recollections; a cleared memory may be repopulated from an unchanged corpus. Conversely, removing an original source and observing no recurrence during a short test does not establish permanent extinction.

10. Defensive architecture

The objective is to prevent untrusted information from authorizing state changes, and to interrupt any remaining reproduction path. The architecture below combines established RAG controls with propagation-specific controls proposed here.

Sources -> ingestion boundary -> permissioned corpus
                                      |
                                      v
Authorized query -> retrieval -> untrusted evidence -> generation
                                                        |
                                                        v
                                               independent action gate
                                                        |
                                       +----------------+----------------+
                                       v                                 v
                              proposed memory write              proposed export
                                       |                                 |
                                       +------ admission decision -------+
                                                        |
                                          traceable downstream artifact

10.1 Corpus and retrieval boundaries

Preserve source identity, integrity metadata, and permissions through document transformation. Enforce access at retrieval time and isolate data across tenants or security domains. Validate incoming sources and retain retrieval audit records. These controls address unauthorized exposure and corpus manipulation described in OWASP LLM08:2025.

Integrity and truth are different properties. A correctly hashed document can contain adversarial instructions, and a valid signature authenticates an origin rather than the safety of its contents. Legitimate authorization to read a passage does not grant that passage authority to authorize an action.

10.2 Interpretation and action boundaries

Separate instructions from retrieved evidence in context construction. Use injection detection and output inspection as supporting controls, constrain tool permissions, and require independent authorization for consequential actions. Human review should receive the proposed action and relevant evidence. These measures follow the layered approach in OWASP Prompt Injection Prevention.

Delimiters, classifiers, and model refusals are fallible behavioral defenses. The security boundary should reside in application code that checks identity, task scope, destination, and permitted operation. A classifier’s acceptance must not manufacture a new permission. Review is also ineffective if a person approves an action without seeing the source-derived reason for it.

10.3 Persistence, observability, and recovery

Control index writes, preserve provenance, validate model outputs, trace tool activity, and propagate deletion or permission changes into derived indexes and caches. Maintain rollback procedures and fail closed when required authorization checks fail. The OWASP RAG Security Cheat Sheet treats these as pipeline-wide responsibilities spanning ingestion through downstream agent integration.

For propagation analysis, add a distinct promotion decision: model-generated material should enter knowledge or memory through an explicit admission policy. Store its derivation and trust class so that synthesis does not silently convert source claims into authoritative instructions. Measure the fraction of viable descendants stopped at this boundary.

Treat promotion and export as graph edges that defenders can disable independently. A practical containment exercise should demonstrate that suspending these edges stops new lineages while preserving whatever read-only service remains authorized. Removing one suspicious document is insufficient if descendants remain reachable.

Recovery should be lineage-aware: identify affected derivations, quarantine candidate descendants, validate repairs, and replay bounded workloads against the recovered state. Retain only the sensitive trace data needed for this process, with access controls and defined retention. Detection of one carrier does not justify assuming that all semantically related documents are infected.

11. Measurement framework

An evaluation should expose the entire causal chain. A single aggregate attack-success rate obscures whether a control blocked retrieval, activation, writing, or downstream establishment.

Use independent experimental runs as the primary uncertainty unit when hosts and descendants share a lineage. Cluster-aware intervals or run-level bootstrap estimates are more appropriate than treating every chunk as an independent sample. Report trial counts and uncertainty alongside means; a point estimate of zero from a small sample is not proof of impossibility.

Stratify results by model version, corpus, retrieval configuration, workflow permissions, and defense configuration. High exposure with low activation indicates a different failure boundary from low exposure with high activation. Both matter when the workload changes.

12. Safe experimental methodology

The research question is whether a bounded system permits unauthorized semantic inheritance, and where controls interrupt it. Evaluating that question does not require harmful actions or access to real users.

1. Predeclare the claim. Specify the host boundary, carrier unit, allowed seed access, query distribution, harmless deviation criterion, generation cap, and observation horizon. Distinguish testing storage contamination from testing autonomous reproduction.
2. Build a closed test environment. Use disposable corpora, synthetic identities, non-sensitive records, isolated tenants, and simulated destinations. Disable external delivery and live credentials. Enforce run limits and a stop control outside the model.
3. Use non-destructive outcomes. Represent a deviation by an inert annotation or sandbox-only state change. Keep the instruction-bearing test material under controlled access; published reports can describe its behavioral criterion without reproducing reusable attack text.
4. Separate plumbing from behavior. First validate provenance and event counting with explicitly authorized inert data. Then evaluate whether lower-trust content causes the predeclared unauthorized behavior. Copying an approved marker tests transport only and must not be reported as a successful worm.
5. Include causal controls. Compare clean content, matched content with the adversarial behavioral component neutralized, retrieval disabled, persistence disabled, and export disabled. Keep legitimate task information as comparable as possible. Perform paired replays or randomized assignment to distinguish carrier effects from baseline model errors.
6. Stop external reseeding. After the initial controlled introduction, freeze adversary edits. Descendants must originate from observed application behavior. Researcher insertion of a fresh carrier at every generation demonstrates repeated poisoning, not autonomous propagation.
7. Validate descendants independently. Remove access to the original carrier and unrelated affected state when replaying a child in a fresh destination. Record whether the child causes a further sandboxed descendant under the declared workload. A bounded test supports only the generations actually observed.
8. Evaluate defenses and recovery. Measure each stage before and after controls, retain clean-task baselines, and test removal of both corpus and memory descendants. Record failures and utility costs, not just successful containment runs.
9. Publish reproducible measurements. Release configuration, corpus statistics, harmless fixtures, counting rules, aggregate results, and uncertainty estimates. Omit credentials, private traces, optimized attack prompts, and mechanisms for uncontrolled delivery. Report all tested conditions and limitations.

Changing the model, reranker, parser, memory policy, or write permissions changes the experimental system. Record versions and rerun the relevant evaluation rather than assuming that previous measurements transfer unchanged.

A safe experiment may deliberately restrict the very communication paths that enable realistic propagation. Report that restriction explicitly. Simulation can test causality and containment under its assumptions, but it cannot establish uncontrolled real-world spread.

13. Limitations and research questions

The proposed model is an abstraction. Real systems contain overlapping corpora, shared models, human decisions, nonstationary workloads, and asynchronous updates. Semantic viability is also environment-dependent: a descendant that works in one context may be inert in another. Finite replay cannot prove indefinite self-reproduction.

The sources cited here do not establish a universal infection rate or population-wide incidence. Their controlled results motivate research into the following questions:

• Which transformations preserve reproduction capability, and which preserve only the carrier’s topic or appearance?
• How much measured propagation comes from new descendants rather than repeated exposure to one shared source?
• Can lineage tracking remain reliable across summaries, translations, and memory consolidation without excessive data retention?
• Which admission policies reduce descendant establishment while preserving legitimate learning and knowledge updates?
• How do cross-store pathways change containment when direct corpus-to-corpus propagation is already blocked?
• Which reproduction estimates remain useful under correlated workloads, human review, and rapidly changing application permissions?

The central security property is a break in the causal loop: retrieved evidence must not be able to create new behavioral authority merely because an application reformulates, stores, or distributes it. A defensible RAG-worm claim must show that loop operating through viable descendants; a defensible containment claim must show where it is interrupted.

References

1. Stav Cohen, Ron Bitton, and Ben Nassi. Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications. First submitted 2024; revised 2025. Introduces Morris II. arXiv:2403.02817.
2. Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models. 34th USENIX Security Symposium, 2025, pp. 3827–3844; preprint first submitted 2024. USENIX publication; arXiv:2402.07867.
3. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases. NeurIPS, 2024. Conference paper; arXiv:2407.12784.
4. OWASP Cheat Sheet Series. Retrieval-Augmented Generation (RAG) Security Cheat Sheet. Living guidance. Official document.
5. OWASP Gen AI Security Project. LLM08:2025 — Vector and Embedding Weaknesses. Official risk entry.
6. OWASP Cheat Sheet Series. LLM Prompt Injection Prevention Cheat Sheet. Living guidance. Official document.

Research papers and guidance were consulted during preparation in September 2026. The taxonomy, notation, and reproduction metrics in this article are proposed analytical constructs; they should not be attributed to OWASP or treated as standardized measures.