Researchers from Cornell Tech, the Israel Institute of Technology, and Intuit have created Morris II — the first computer worm designed to target generative AI ecosystems through adversarial self-replicating prompts, demonstrating zero-click propagation across interconnected AI agents powering email assistants, chatbots, and autonomous workflows.
How Morris II Propagates
Named after the infamous 1988 Morris Worm that paralyzed the early internet, Morris II exploits a fundamental weakness in how GenAI agents process and share information. The attack works by injecting specially crafted adversarial self-replicating prompts into inputs processed by AI models. When the model processes this prompt, it is forced to replicate the prompt as part of its output — and simultaneously execute a malicious payload such as data exfiltration or spam propagation.
The worm specifically targets systems using Retrieval Augmented Generation (RAG), where AI agents store and retrieve context from shared databases. Once a single agent is compromised, the adversarial prompt is stored in the RAG database and passively propagates to every subsequent agent that queries the same data — achieving zero-click propagation without any additional attacker intervention.
Tested Against Major Models
The researchers demonstrated Morris II against GenAI-powered email assistants in two attack scenarios — mass spam propagation and personal data exfiltration — across three different models: Google Gemini Pro, OpenAI ChatGPT 4.0, and the open-source LLaVA. Both text-based and image-based adversarial prompts were tested under black-box and white-box conditions, with the worm successfully extracting emails, addresses, and phone numbers while propagating to new agents in the ecosystem.
The Virtual Donkey: A Proposed Guardrail
The researchers also introduced Virtual Donkey, a proposed guardrail designed to detect and prevent Morris II propagation. Testing showed a perfect true-positive rate of 1.0 with a false-positive rate of just 0.015, and robustness against out-of-distribution worms with unseen jailbreaking commands.
While Morris II has not been observed in the wild, OpenAI and Google both acknowledged the vulnerability and stated they are working on countermeasures. As enterprises deploy increasingly interconnected AI agent ecosystems, the research underscores the urgent need for API segmentation, input sanitization at every agent boundary, behavioral anomaly detection, and strict isolation between agent contexts.