LLM Agent Worms Require No Hacking Skills—Just One Paragraph
Agent systems have no memory overflow vulnerabilities. No buffer overflows. No code injection points in the traditional sense. Therefore, agents are secure.
That reasoning chain was severed on May 4, 2026, by a 21-page paper from Mingming Zha (Indiana University) and XiaoFeng Wang (Nanyang Technological University): *Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense*. The authors achieved zero-click autonomous worm propagation on three open-source production agent frameworks—exploiting no traditional vulnerabilities, no memory corruption, no network protocol flaws. Only a piece of natural-language text was required.
Reading Is More Dangerous Than Writing
Traditional security thinking protects boundaries: firewalls, access control, code audits. Agents appear immune—they don't run native code, touch raw memory, or listen on ports. They read natural-language files, load them into the LLM context, and decide what to do next based on that content.
That is exactly the problem. The paper's core finding: in LLM-mediated systems, a read operation can be more dangerous than a write. This overturns three decades of security intuition. In agent architectures, reading a poisoned file injects the attacker's voice directly into the decision-maker's ear. Reading is control.
The Attack Model
The attacker needs no filesystem access, no platform source modifications, no model tampering. They only need to place a text payload where an agent will process it—a shared Slack channel, a public Telegram group, a document the agent fetches. The agent, induced by the text, writes the content (or a semantic equivalent) into a persistent carrier: heartbeat files, task state, memory summaries, or calendar entries. On the next scheduled task, it re-reads the carrier, reloading poisoned content into its decision context, driving high-risk operations—messaging other agents, modifying configs, calling tools. Receiving agents repeat the loop: persistent worm propagation.
Headline Results
- Persistence, re-entry, propagation, privilege escalation: achieved on all three frameworks (anonymized A/B/C due to ongoing coordinated disclosure).
- Cross-platform spread: infected Agent A infected Agent B (different framework) via a shared channel, which infected Agent C—3 hops, no platform-specific adaptation.
- Speed: limited only by heartbeat intervals; with short intervals, an entire reachable agent ecosystem could be compromised in minutes, zero human interaction after initial injection.
- Model compliance: GPT-4o-mini — 100% single-hop, 100% multi-hop. Gemini-2.5-Flash — 100% single-hop, 100% multi-hop. The paper states this is a *structural property of agent architecture*, not a model-specific weakness.
- SSCGV (Static Source-Code Graph Vulnerability analyzer): takes an agent platform's source repository, builds code property graphs, traces data flow from file I/O to LLM context injection points, and ranks injectable carriers by injection position—no manual analysis or platform-specific knowledge required.
- SRPO (Summary-Resilient Payload Optimizer): real agent communication involves summarization, compression, paraphrasing, which destroys verbatim payloads. SRPO uses three LLM roles—generator, transformation simulator, judge—to optimize payloads across persistence, propagation, operational effect, and critical-token retention, ensuring instructions survive multiple transformation steps.
- Title: Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense
- Authors: Mingming Zha (Indiana University Bloomington), XiaoFeng Wang (Nanyang Technological University)
- Contact: mzha@iu.edu, xiaofeng.wang@ntu.edu.sg
- arXiv: https://arxiv.org/abs/2605.02812 (PDF: https://arxiv.org/pdf/2605.02812.pdf)
- Published: May 4, 2026, cs.CR, 21 pages
- Key data: 31 persistent carriers (5 system-prompt, 26 user-prompt); 100% compliance for GPT-4o-mini and Gemini-2.5-Flash (single and multi-hop); 3-hop cross-platform propagation with zero human interaction
- Disclosure: coordinated disclosure ongoing; maintainers of all affected frameworks notified; framework names, carrier paths, payload templates, and exploit scripts withheld
Counter-Intuitive Finding: User-Prompt Carriers Are Stronger
Conventional wisdom treats system prompts as more authoritative and harder to subvert. But LLM instruction-hierarchy training makes models treat user-turn content as direct commands, and recency bias gives end-of-context instructions disproportionate weight. Heartbeat files load into the user-prompt position at the end of the context—treated as "a command just received." The SSCGV analyzer found 31 persistent carriers across the three frameworks: only 5 system-prompt carriers versus 26 user-prompt carriers, with the latter also more effective.
The Automated Toolchain
Can Permission Systems Stop It?
Partially. Testing framework A's built-in capability system across four configurations: full permissions—attack succeeded; message sending disabled—persistence without propagation; file writes disabled—propagation without persistence; minimal permissions—attack blocked, but legitimate agent operations blocked too.
Capability-based access control shrinks the attack surface but does not eliminate the threat, because the attack operates entirely within authorized permissions. Writing and reading carrier files are both authorized operations. The danger lies in the temporal sequence: a poisoned write followed by an exposed read reintroduces contamination into the decision context—something capability systems cannot enforce.
The Defense: RTW-A
The proposed RTW-A (Read-Then-Write with Attenuation) framework operates beneath the permission layer, enforcing temporal constraints: sealing configs that protect high-authority static files, typed memory promotion preventing free-form summaries from entering trusted memory, and capability attenuation limiting high-risk operations after external reads. The paper proves under a formal *No-Persistent-Worm-Propagation Theorem* that these mechanisms block any attacker-controlled content from completing the propagation chain. Until RTW-A is widely deployed, existing production agent frameworks are exposed.
Paper Details
This is not a future threat. It was demonstrated on production frameworks and requires no hacking techniques—only an understanding of how agents work, and one well-written paragraph.