Zero-Click LLM Agent Worms: No Hacking Skills Required, Just a Paragraph
Agent frameworks have no buffer overflows, no memory corruption, no traditional code injection points—so they must be safe. This reasoning chain was decisively broken on May 4, 2026, by a 21-page paper: “Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense” by Mingming Zha (Indiana University Bloomington) and XiaoFeng Wang (Nanyang Technological University).
The authors achieved zero-click autonomous worm propagation on three open-source production agent frameworks. No traditional vulnerabilities exploited. No memory corruption. No protocol flaws. Only a piece of natural-language text.
The Core Insight: Reading Can Be More Dangerous Than Writing
Conventional security protects boundaries: firewalls, access control, code audits. Agents appear immune—they don't run native code, touch raw memory, or listen on ports. They read natural-language files, load them into the LLM context, and act based on that content.
That's exactly the problem. The paper's central finding: in LLM-mediated systems, a read operation can be more dangerous than a write. When an agent reads a tainted file, it loads the attacker's words directly into the decision-maker's context. The LLM then decides next actions—updating memory, changing configuration, invoking tools, messaging other agents. Reading is control.
The Attack Model
The attacker needs no filesystem access, no source-code modification, no model-weight tampering. They only need to place a text payload in a channel the agent processes—a shared Slack channel, a public Telegram group, a fetched document. The agent is induced to write the payload (or semantic equivalent) into a persistent carrier: heartbeat files, task state, memory summaries, schedules. The next scheduled task re-loads the tainted carrier into the decision context, driving high-risk operations—messaging other agents, changing configs, invoking tools. Recipients repeat the loop: persistent worm propagation.
Results on Three Production Frameworks
On three anonymized open-source frameworks (coordinated disclosure ongoing), the attack achieved persistence, re-entry, propagation, and privilege escalation—all confirmed:
- 3-hop cross-platform propagation: an agent on Framework A infects an agent on a completely different framework via a shared message channel, which infects Framework C. No platform-specific adaptation needed.
- Speed limited only by heartbeat intervals: with short intervals, an entire reachable agent ecosystem falls within minutes, with zero human interaction after initial injection.
- Model results: GPT-4o-mini — 100% single-hop and 100% multi-hop compliance. Gemini-2.5-Flash — 100% single-hop and 100% multi-hop compliance.
- SSCGV (Static Source-Code Graph Vulnerability analyzer): takes an agent platform's source repository, builds code property graphs, traces data flow from file I/O to LLM context injection points, and ranks all injectable carriers by injection position. No manual analysis, no platform-specific knowledge required.
- SRPO (Summary-Resilient Payload Optimizer): solves a deeper problem—real agent communication is summarized, compressed, paraphrased. SRPO uses three LLM roles (generator, transformation simulator, judge) to optimize payloads across four dimensions: persistence, propagation, operational effect, and critical-token retention. Payloads survive summarization and paraphrasing across multiple propagation hops: semantic decay happens, but slower than propagation.
- Title: Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense
- Authors: Mingming Zha (Indiana University Bloomington), XiaoFeng Wang (Nanyang Technological University)
- Emails: mzha@iu.edu, xiaofeng.wang@ntu.edu.sg
- arXiv ID: 2605.02812
- arXiv URL: https://arxiv.org/abs/2605.02812
- PDF URL: https://arxiv.org/pdf/2605.02812.pdf
- Published: May 4, 2026 | cs.CR | 21 pages
- Key contributions: 1. SSCGV: automated source-code graph vulnerability analysis discovering injectable persistence carriers with zero manual effort 2. SRPO: summary-resilient payload optimization robust to LLM-mediated summarization/paraphrase/compression 3. First zero-click autonomous worm: 3-hop cross-platform propagation without platform-specific adaptation 4. Two empirical insights: user-prompt carriers yield higher compliance than system-prompt carriers; reads can be more dangerous than writes 5. RTW-A defense framework with a formal “No Persistent Worm Propagation” theorem
- Key data: 31 persistent carriers (5 system-prompt + 26 user-prompt); 100% single/multi-hop compliance on GPT-4o-mini and Gemini-2.5-Flash; 3-hop cross-platform spread, zero human interaction; ecosystem compromise within minutes at short heartbeat intervals
- Cohen, Bitton, Nassi. Here comes the AI worm (arXiv:2403.02817, 2024)
- Zhang et al. ClawWorm: Self-Propagating Attacks Across LLM Agent Ecosystems (arXiv:2603.15727, 2026)
- Chen et al. AgentPoison (NeurIPS 2024)
- Dong et al. A practical memory injection attack against LLM agents (arXiv:2503.03704, 2025)
- Lee & Tiwari. Prompt infection: LLM-to-LLM prompt injection (arXiv:2410.07283, 2024)
- Wallace et al. The instruction hierarchy (arXiv:2404.13208, 2024)
- Liu et al. Lost in the middle (TACL, 2024)
The paper states explicitly: “File-mediated worm propagation is primarily a structural property of agent architectures, not a weakness of particular models.”
A Counter-Intuitive Finding: User-Prompt Carriers Outperform System-Prompt Carriers
Conventional wisdom says system prompts are “more authoritative” and harder to subvert. But LLM instruction-hierarchy training makes models treat user-turn content as direct operational commands, and recency bias gives instructions at the end of the context window disproportionate attention. Heartbeat files loaded into the user-prompt position land exactly at the context's end—processed as “a just-received direct command.”
Across the three frameworks, the SSCGV analyzer found 31 persistent carriers: 5 system-prompt carriers and 26 user-prompt carriers—the latter over five times more numerous and more effective.
The Automated Toolchain
Can Permission Controls Stop This?
The paper tested Framework A's built-in permission system under four configurations: full permissions—attack succeeds; messaging disabled—persistent infection but no propagation; file writes disabled—propagation possible but persistence blocked; least privilege—blocks the attack but also blocks legitimate agent operations.
Key conclusion: capability-based access control reduces the attack surface but does not eliminate the threat, because the attack operates entirely within authorized permissions. Writing to a carrier is authorized; reading it is authorized. The danger lies in the temporal ordering between operations—which capability controls cannot enforce.
The Defense: RTW-A
RTW-A (Read-Then-Write with Attenuation) operates below the permission layer, enforcing temporal constraints: blocking exposed re-entry of tainted carriers, sealed configurations for static high-authority files, typed memory promotion preventing free-form summaries into trusted memory, and capability attenuation restricting high-risk operations after external reads. The paper proves, under a formal “No Persistent Worm Propagation” theorem, that this combination stops any attacker-controlled content from completing the propagation chain.
But until RTW-A is widely deployed, existing production agent frameworks are exposed.
Disclosure Status
“Coordinated disclosure is in progress. Maintainers of all affected frameworks have been notified.” The three frameworks are anonymized; specific carrier paths, payload templates, and exploit scripts are withheld.
This is not a future threat. It is a present vulnerability, demonstrated on production frameworks, requiring no hacking technique—only an understanding of how agents work, and one paragraph of text that the agent will read, decide to save, and read again.
---
Paper Details
Cited works: