Morris II: researchers show a zero-click worm spreading between AI agents through self-copying prompts

Researchers published a paper (arXiv:2403.02817, submitted March 5, 2024) demonstrating an AI worm dubbed 'Morris II', after the 1988 Morris worm. Crafted as an adversarial self-replicating prompt, it exploits RAG-based GenAI applications — demonstrated against Gemini Pro, GPT-4 and LLaVA — to trigger a chain of indirect prompt injections that spread the payload to other agents with zero clicks, using email-assistant spam and data-exfiltration as the demonstrated use cases.

What this means for youAt home, an AI assistant that reads your email can be given orders by an email, and can pass them on. At work and in government, any AI connected to email or shared documents needs the same containment you would give a new employee with an inbox: limits on what it can send and where.