Nassi et al. "ComPromptMized" Morris II multi-agent worm
Date: 2024-03-05
Affected: GenAI-powered email assistants with contact access and send capabilities — demonstrated on ChatGPT-4 and Gemini Pro; applicable to any agentic system with memory and outbound communication tools
Attack vector: data-exfiltration
Category: research-demonstrated
Severity: Critical

Nassi et al. (Cornell Tech, Technion, Intuit) demonstrated the first generative AI worm capable of self-replicating across multi-agent systems. Named "Morris II" after the 1988 Morris worm, the attack embeds adversarial self-replicating prompts in emails processed by AI email assistants (GenAI-powered). When the assistant reads the poisoned email, the injected prompt causes it to (a) exfiltrate contact data, (b) forward the worm to all contacts in the address book, and (c) store the adversarial prompt in the AI's memory/RAG store for future replication. Demonstrated on ChatGPT-4 and Gemini Pro. The attack exploits the multi-agent communication layer — no user interaction required after initial infection.

Impact: First demonstration of AI worm self-replication across agent ecosystem; establishes multi-agent cascade as a critical attack surface; cross-agent memory poisoning enables persistent reinfection even after initial remediation

Mitigations:
Human approval required before any outbound agent action (email send, contact access)
Immutable audit log of all agent communications with anomaly detection
Input validation and sanitisation for all inter-agent messages
Memory content integrity checks — validate stored content against trust policy before execution
Rate limiting on agent-initiated outbound actions
Sandboxed agent execution with explicit permission grant per action

Architectural layers (MAESTRO):
label: Agent Ecosystem
notes: Agent-to-agent communication exploited for worm propagation — inter-agent messages treated as trusted
role: origin
label: Agent Frameworks
notes: Agent framework executes injected instructions without validation at A2A boundary
role: propagation
label: Data Operations
notes: Memory/RAG stores worm payload for persistence — enables reinfection after initial remediation
role: propagation
label: Evaluation & Observability
notes: No anomaly detection on inter-agent message content or volume
role: blind-spot
label: Security & Compliance
notes: No rate limiting or quarantine on AI-generated outbound actions
role: blind-spot