Autonomous LLM Agent Worms: A Paragraph of Text Is All It Takes
> Paper: Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense > Authors: Mingming Zha (Indiana University Bloomington), XiaoFeng Wang (Nanyang Technological University) > arXiv: 2605.02812 | 2026-05-04 | 21 pages | cs.CR
The Broken Assumption
Agents have no memory-safety bugs, no buffer overflows, no code injection points—so they must be safe. A paper published May 4, 2026 severs that reasoning chain. The authors demonstrated zero-click autonomous worm propagation on three open-source production agent frameworks, requiring no exploitation of traditional vulnerabilities. Just a passage of natural language.
Reading Is More Dangerous Than Writing
Traditional security treats writes as the primary integrity threat. But in agent architectures, an agent reads a file, loads it into its LLM context, and the LLM decides next actions based on that content—updating memory, modifying configs, calling tools, messaging other agents. A polluted read directly injects attacker speech into the decision-maker's ear. Read equals control.
The Attack Model
An attacker needs no filesystem access, no source modification, no model tampering. Plant a text payload in a channel an agent may process—a shared Slack channel, a public Telegram group, a scraped document. The agent is induced to write the content (or semantic equivalent) into a persistent carrier: a heartbeat file, task state, memory summary, or schedule. Scheduled tasks reload the carrier, re-polluting the decision context, which drives high-risk operations and repeats the loop in other agents.
Key Results
- All four objectives met on three frameworks: persistence, re-entry, propagation, privilege escalation (frameworks anonymized as A/B/C; coordinated disclosure ongoing)
- 3-hop cross-platform propagation with zero platform-specific adaptation; entire reachable agent ecosystems compromised in minutes with short heartbeat intervals, no human interaction after initial injection
- 100% compliance for both single-hop and multi-hop on GPT-4o-mini and Gemini-2.5-Flash. Per the paper: file-mediated worm propagation is a *structural property of agent architecture*, not a model-specific weakness
- User-prompt carriers beat system-prompt carriers: SSCGV found 31 persistent carriers (5 system-prompt, 26 user-prompt). Instruction-hierarchy training plus recency bias means heartbeat content loaded at the user-turn position is treated as a direct command
- SSCGV (Static Source-Code Graph Vulnerability analyzer): builds code property graphs from an agent framework's repo, traces data flow from file I/O to LLM context injection points, and ranks injectable carriers automatically—no manual analysis or platform knowledge required
- SRPO (Summary-Resilient Payload Optimizer): real agents summarize and paraphrase communications, killing verbatim payloads. SRPO uses a generator, a transform simulator, and a judge across four objectives: persistence, propagation, operational effect, and critical-token retention—ensuring payloads survive summarization, paraphrasing, and compression across hops
- arXiv: https://arxiv.org/abs/2605.02812 | PDF
- Contact: mzha@iu.edu, xiaofeng.wang@ntu.edu.sg
- Key data: 31 persistent carriers (5 system + 26 user prompt); 100% compliance on GPT-4o-mini / Gemini-2.5-Flash (single and multi-hop); 3-hop cross-platform spread; disclosure status per paper Sections 4 and 9; figures consistent with Tables 1–6
- Related work cited: Cohen et al., *Here Comes the AI Worm* (arXiv:2403.02817); Zhang et al., *ClawWorm* (arXiv:2603.15727); AgentPoison (NeurIPS 2024); Dong et al., memory injection attacks (arXiv:2503.03704); Lee & Tiwari, *Prompt Infection* (arXiv:2410.07283); Wallace et al., *Instruction Hierarchy* (arXiv:2404.13208); Liu et al., *Lost in the Middle* (TACL 2024)
The Toolchain
Permission Controls Are Not Enough
Testing on Framework A's built-in permissions: full permissions → attack succeeds; messaging disabled → persistence without spread; file writes disabled → spread without persistence; least privilege → blocks both attack and legitimate agent operations. Capability-based access control shrinks the attack surface but cannot eliminate the threat, because every step—write carrier, read carrier—is authorized. The danger lies in the temporal ordering of authorized operations.
The Defense: RTW-A
RTW-A (Read-Then-Write with Attenuation) operates below the permission layer, enforcing temporal constraints: sealed configurations protect high-authority static files, typed memory promotion keeps free-form summaries out of trusted memory, and capability attenuation restricts high-risk operations after external reads. The paper proves under a formal No-Persistent-Worm-Propagation Theorem that this combination blocks any attacker-controlled content from completing the propagation chain.
Bottom Line
This is not a future threat—it was demonstrated on production frameworks. Until defenses like RTW-A are widely deployed, current agent frameworks remain exposed. The attack needs no hacking technique, only an understanding of how agents work: write a paragraph that the agent, upon reading it, decides to save for its future self to read again.