{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/here-comes-the-ai-worm-unleashing-zero-click","title":"Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications","arxiv_id":"2403.02817","date":"2024-03-05","proceeding":null,"authors":["Stav Cohen","Ron Bitton","Ben Nassi"],"abstract":"In this paper, we show that when the communication between GenAI-powered applications relies on RAG-based inference, an attacker can initiate a computer worm-like chain reaction that we call Morris-II. This is done by crafting an adversarial self-replicating prompt that triggers a cascade of indirect prompt injections within the ecosystem and forces each affected application to perform malicious actions and compromise the RAG of additional applications. We evaluate the performance of the worm in creating a chain of confidential user data extraction within a GenAI ecosystem of GenAI-powered email assistants and analyze how the performance of the worm is affected by the size of the context, the adversarial self-replicating prompt used, the type and size of the embedding algorithm employed, and the number of hops in the propagation. Finally, we introduce the Virtual Donkey, a guardrail intended to detect and prevent the propagation of Morris-II with minimal latency, high accuracy, and a low false-positive rate. We evaluate the guardrail's performance and show that it yields a perfect true-positive rate of 1.0 with a false-positive rate of 0.015, and is robust against out-of-distribution worms, consisting of unseen jailbreaking commands, a different email dataset, and various worm usecases.","url_abs":"https://arxiv.org/abs/2403.02817v2","url_pdf":"https://arxiv.org/pdf/2403.02817v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"here-comes-the-ai-worm-unleashing-zero-click","repo_url":"https://github.com/stavc/compromptmized","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2403.02817","atlas_url":"https://app.syntology.ai/?focus=2403.02817","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2403.02817"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/stavc/compromptmized","reach":{"status":"ok"}}],"summary":{"ran":2,"unverified":6},"by_repo_kind":{"official":{"samples":8,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"3e0c20655c425cf6","entry":"receive_complete_data","repo":"stavc/compromptmized","repo_kind":"official","path":"Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EmailServer/EmailServer.py","file_url":"https://github.com/stavc/compromptmized/blob/HEAD/Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EmailServer/EmailServer.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3e0c20655c425cf6"}},{"code_sha256_prefix":"c3fcbd96976218e7","entry":"receive_complete_data","repo":"stavc/compromptmized","repo_kind":"official","path":"Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EndUserCode/EndUserClient.py","file_url":"https://github.com/stavc/compromptmized/blob/HEAD/Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EndUserCode/EndUserClient.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c3fcbd96976218e7"}},{"code_sha256_prefix":"a2445eba62e3b93d","entry":"load_model","repo":"stavc/compromptmized","repo_kind":"official","path":"Legacy_Arxiv_V1/FlowSteering/llava/serve/model_worker.py","file_url":"https://github.com/stavc/compromptmized/blob/HEAD/Legacy_Arxiv_V1/FlowSteering/llava/serve/model_worker.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a2445eba62e3b93d"}},{"code_sha256_prefix":"ec85aba0605e5453","entry":"parse_email_data","repo":"stavc/compromptmized","repo_kind":"official","path":"Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EndUserCode/EndUserClient.py","file_url":"https://github.com/stavc/compromptmized/blob/HEAD/Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EndUserCode/EndUserClient.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ec85aba0605e5453"}},{"code_sha256_prefix":"37899f22fb191b37","entry":"pretty_print_semaphore","repo":"stavc/compromptmized","repo_kind":"official","path":"Legacy_Arxiv_V1/FlowSteering/llava/utils.py","file_url":"https://github.com/stavc/compromptmized/blob/HEAD/Legacy_Arxiv_V1/FlowSteering/llava/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"37899f22fb191b37"}},{"code_sha256_prefix":"34962d308ed86b96","entry":"send_Email","repo":"stavc/compromptmized","repo_kind":"official","path":"Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EndUserCode/AttackerClient.py","file_url":"https://github.com/stavc/compromptmized/blob/HEAD/Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EndUserCode/AttackerClient.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"34962d308ed86b96"}},{"code_sha256_prefix":"72ab0ce247e7433d","entry":"send_Email","repo":"stavc/compromptmized","repo_kind":"official","path":"Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EndUserCode/EndUserClient.py","file_url":"https://github.com/stavc/compromptmized/blob/HEAD/Legacy_Arxiv_V1/FlowSteering/ApplicationCode/EndUserCode/EndUserClient.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"72ab0ce247e7433d"}},{"code_sha256_prefix":"f9939a84b9a65279","entry":"violates_moderation","repo":"stavc/compromptmized","repo_kind":"official","path":"Legacy_Arxiv_V1/FlowSteering/llava/utils.py","file_url":"https://github.com/stavc/compromptmized/blob/HEAD/Legacy_Arxiv_V1/FlowSteering/llava/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f9939a84b9a65279"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}