LLM Agent Worms Need No Hacking Skills - Just One Paragraph
A 21-page paper titled Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense by Mingming Zha (Indiana University Bloomington) and XiaoFeng Wang (Nanyang Technological University) was released on arXiv (2605.02812, cs.CR, May 4, 2026). It demonstrates zero-click, self-propagating worms on three open-source production agent frameworks - requiring no traditional vulnerabilities, no memory corruption, no protocol flaws. Just a paragraph of natural language.
The Core Insight: Reading Is More Dangerous Than Writing
The paper's central finding inverts three decades of security intuition: in LLM-mediated systems, a read operation can be more dangerous than a write operation. An agent reads a poisoned file (a Slack message, a document), loads it into the LLM context, and the model then decides to write the content or a semantic equivalent into a persistent carrier - a heartbeat file, task state, memory summary, or schedule record. On the next scheduled task, the agent reloads the carrier, re-poisoning its decision context and driving high-risk operations: messaging other agents, modifying configuration, invoking tools. Each recipient repeats the cycle.
Measured Results
- 3-hop cross-platform propagation: an agent on Framework A infects an agent on a completely different Framework B via a shared message channel, which infects Framework C - no platform-specific adaptation needed.
- 100% compliance for both single-hop and multi-hop propagation on GPT-4o-mini and Gemini-2.5-Flash. Per the paper: file-mediated worm propagation is a *structural property of agent architectures*, not a model-specific weakness.
- Propagation speed is bounded only by heartbeat intervals; with short intervals, an entire reachable agent ecosystem can be compromised within minutes, with zero human interaction after initial injection.
- User-prompt carriers beat system-prompt carriers: LLM instruction-hierarchy training plus recency bias make user-turn content act as direct commands. The SSCGV analyzer found 31 persistent carriers across the three frameworks - 5 system-prompt carriers vs. 26 user-prompt carriers.
- SSCGV (Static Source-Code Graph Vulnerability analyzer): takes any agent framework's source repository, builds a code property graph, traces data flows from file I/O to LLM context injection points, and ranks injectable carriers by injection location - no manual analysis or platform knowledge required.
- SRPO (Summary-Resilient Payload Optimizer): real agent communication summarises, compresses, and paraphrases messages, which would normally destroy payloads. SRPO uses three LLM roles (generator, transform simulator, judge) to optimize payloads across four dimensions: persistence, propagation, operational effect, and critical-token retention - so the core instruction survives even after three transformation steps.
- Title: Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense
- Authors: Mingming Zha (mzha@iu.edu), XiaoFeng Wang (xiaofeng.wang@ntu.edu.sg)
- arXiv: 2605.02812 | PDF
- Published: May 4, 2026 | cs.CR | 21 pages
- Key cited works: Cohen et al., *Here Comes the AI Worm* (arXiv:2403.02817); Zhang et al., *ClawWorm* (arXiv:2603.15727); Chen et al., *AgentPoison* (NeurIPS 2024); Dong et al., memory injection attack (arXiv:2503.03704); Lee & Tiwari, *Prompt Infection* (arXiv:2410.07283); Wallace et al., *Instruction Hierarchy* (arXiv:2404.13208); Liu et al., *Lost in the Middle* (TACL 2024)
The Automated Attack Toolchain
Why Permission Controls Don't Stop It
The paper tested Framework A's built-in permission system under four configurations: full permissions - attack succeeds; no message sending - persistence but no propagation; no file writing - propagation but no persistence; minimal privileges - attack blocked but legitimate agent functionality also blocked. The attack operates entirely within authorized permissions; capability-based access control cannot enforce the *temporal ordering* between a poisoned write and a subsequent exposed read.
The Defense: RTW-A
RTW-A (Read-Then-Write with Attenuation) operates below the permission layer, enforcing temporal constraints: sealing static high-authority files, typed memory promotion to keep free-form summaries out of trusted memory, and capability attenuation limiting high-risk operations after external reads. The paper proves under a formal "no-persistent-worm-propagation theorem" that these mechanisms block any attacker-controlled content from completing the propagation chain.
Disclosure Status
Coordinated disclosure is underway; maintainers of all affected frameworks have been notified. Frameworks are anonymized as A/B/C, and specific carrier paths, payload templates, and exploit scripts are withheld.