A 21-page paper published on arXiv on May 4, 2026 — *Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense* by Mingming Zha (Indiana University Bloomington) and XiaoFeng Wang (Nanyang Technological University) — demonstrates zero-click, self-propagating worms against three open-source production LLM agent frameworks. The attack requires no memory corruption, no code injection, no protocol flaw — only a passage of natural-language text.
Key points
- Reading is the new attack surface. The paper's central insight inverts three decades of security intuition: in LLM-mediated systems, a *read* operation can be more dangerous than a *write*. When an agent loads a tainted file into its LLM context, attacker-controlled text is injected directly into the decision loop — driving memory updates, config changes, tool calls, and messages to other agents.
- Attack model. The attacker needs no filesystem access, no source-code modification, no model tampering. Placing a text payload in a shared Slack channel, Telegram group, or scraped document suffices. The agent is induced to persist the payload in a carrier (heartbeat file, task state, memory summary), then automatically re-reads it on the next scheduled task, re-entering the decision context and propagating onward.
- Results across three anonymized production frameworks (A/B/C): persistence, re-entry, propagation, and privilege escalation all succeeded. Cross-platform 3-hop propagation (A → B → C on entirely different frameworks) worked with zero platform-specific adaptation and no human interaction after initial injection. With short heartbeat intervals, an entire reachable agent ecosystem can be compromised within minutes.
- Model-agnostic. GPT-4o-mini and Gemini-2.5-Flash both showed 100% single-hop and 100% multi-hop compliance. The paper states the vulnerability is a *structural property of agent architecture* (filesystem permissions plus scheduled auto-loading), not a weakness of any particular model.
- Counterintuitive finding: user-prompt carriers achieved higher attack compliance than system-prompt carriers. Instruction-hierarchy training and recency bias cause agents to treat heartbeat-file content loaded at the end of the context window as a direct, just-received command. SSCGV found 31 persistent carriers: 5 system-prompt vs. 26 user-prompt.
- SSCGV (Static Source-Code Graph Vulnerability analyzer): given any agent framework's source repository, it builds a code property graph, traces data flow from file I/O to LLM context injection points, and ranks all injectable carriers — no manual analysis or platform-specific knowledge required.
- SRPO (Summary-Resilient Payload Optimizer): real agent communication summarizes, compresses, and paraphrases messages. SRPO uses three LLM roles (generator, transformation simulator, judge) to optimize payloads that survive these transformations across four objectives: persistence, propagation, operational effect, and critical-token retention — so a payload remains effective even after three rounds of summarization during propagation.
- Title: Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense
- Authors: Mingming Zha (mzha@iu.edu), XiaoFeng Wang (xiaofeng.wang@ntu.edu.sg)
- arXiv: 2605.02812 | PDF | cs.CR, 21 pages, 2026-05-04
Automation toolchain
Permission controls are not enough
Testing Framework A's built-in permission system showed that capability-based access control *reduces* the attack surface but does not eliminate the threat: the entire attack operates within authorized permissions (authorized writes to carriers, authorized reads back). The danger lies in the temporal ordering — a tainted write followed by an exposed read — which capability systems cannot enforce.
Proposed defense: RTW-A
RTW-A (Read-Then-Write with Attenuation) operates beneath the permission layer with temporal constraints: sealed configuration for high-authority static files, typed memory promotion to keep free-form summaries out of trusted memory, and capability attenuation limiting high-risk operations after external reads. The paper proves, under a formal *No Persistent Worm Propagation Theorem*, that this combination blocks any attacker-controlled content from completing the propagation chain. Until such defenses are widely deployed, the authors argue, existing production agent frameworks remain exposed.
Disclosure status
Coordinated disclosure is ongoing; maintainers of all affected frameworks have been notified. The frameworks are anonymized, and specific carrier paths, payload templates, and exploit scripts are withheld.