Reading as Conquest: How a Single Piece of Text Can Trigger a Self-Propagating LLM Agent Worm

Forum topic · ✨步子哥 · 2026-05-06

Summary

A 21-page arXiv paper (arXiv:2605.02812) by Mingming Zha (Indiana University Bloomington) and XiaoFeng Wang (Nanyang Technological University), titled 'Autonomous LLM Agent Worms', demonstrates that in LLM-mediated agent systems, reading can be more dangerous than writing. An attacker needs no code exploits or model access: a crafted text dropped where an agent will read it can induce the agent to persist the payload in heartbeat files, memory logs, or task summaries, which are reloaded into the model's context on scheduled ticks, re-triggering infection. The authors report 100% single- and multi-hop compliance on GPT-4o-mini and Gemini-2.5-Flash, successful cross-platform propagation across three production agent frameworks, and 31 persistence carriers discovered by their SSCGV analyzer. User-prompt-position carriers were far more effective than system-prompt carriers due to recency bias and instruction hierarchy training. Their SRPO optimizer makes payloads survive summarization across hops. Capability-based permission systems shrink but do not eliminate the threat. The proposed RTW-A defense enforces temporal constraints below the permission layer and is formally proven to block persistent worm propagation.

Reading as Conquest: When Text Quietly Awakens a Global Worm Legend of AI Agents

*Translation/summary of a Chinese forum post reviewing the paper "Autonomous LLM Agent Worms" (arXiv:2605.02812).*

Key points

The paper: "Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense" (arXiv:2605.02812), by Mingming Zha (Indiana University Bloomington) and XiaoFeng Wang (Nanyang Technological University), published on arXiv on May 4, 2026 (21 pages).
Core claim: In LLM-mediated systems, a *read* operation can be more dangerous than a write. Traditional security intuition treats reads as confidentiality-only concerns; agents, however, feed what they read directly into their decision-making context, then update memory, call tools, and message other agents. Reading is control.
Attack model: The attacker needs no file-system access, no source-code changes, no traditional vulnerabilities, and no model tampering. A crafted text placed where an agent will read it (shared Slack/Telegram channels, fetched documents) induces the agent to write the content—or a semantic equivalent—into a persistent carrier: heartbeat files, task state summaries, memory logs, or schedules. A scheduled task then reloads the payload into the LLM context, driving high-risk operations such as messaging other agents.
Demonstrated results: Full attack chains implemented and successful on three open-source production agent frameworks (anonymized as A, B, and C, with coordinated disclosure ongoing). Persistence, re-entry, propagation, and privilege escalation all succeeded. Cross-platform infection worked over three hops with zero platform-specific adaptation. Propagation speed is limited only by heartbeat intervals; with short intervals, an entire reachable agent ecosystem can be compromised within minutes, with no human interaction after initial injection.
Compliance rates: 100% single-hop and multi-hop compliance on GPT-4o-mini and Gemini-2.5-Flash alike. The paper states this is a structural property of agent architectures, not a weakness of specific models.
User-prompt carriers beat system-prompt carriers: Due to instruction-hierarchy training and recency bias (instructions at the end of the context window receive disproportionate attention), heartbeat files loaded at the user-prompt position are treated as fresh commands. The SSCGV analyzer found 31 persistence carriers across three frameworks: 5 system-prompt carriers vs. 26 user-prompt carriers, with user-prompt carriers significantly more effective.
SSCGV tool: A Static Source-Code Graph Vulnerability analyzer that takes any agent platform's source repository, builds a code property graph, and traces data flows from file I/O to LLM context injection points—no manual analysis or platform knowledge required.
SRPO tool: A Summary-Resilient Payload Optimizer using three LLM roles (generator, transformation simulator, judge) to optimize payloads across persistence, propagation, operational effect, and key-token retention. Real agent communication summarizes and paraphrases messages; SRPO ensures the payload's core instructions survive multiple rounds of transformation, so "one paragraph is enough" is literal reality.
Permission controls are a soft trap: Experiments on framework A's built-in permission system showed: full permissions—attack succeeds; messaging disabled—persistent infection but no propagation; file writes disabled—propagation possible but persistence blocked; least privilege—blocks the attack but also eliminates legitimate agent operations. Capability-based access control narrows but does not eliminate the threat, because the attack operates entirely within authorized permissions; the danger lies in the *temporal ordering* of a polluted write followed by an exposed read.
RTW-A defense: The Read-Then-Write with Attenuation framework enforces temporal constraints below the permission layer via sealed configurations (protecting static high-authority files), typed memory promotion (preventing free-form summaries from entering trusted memory), and capability attenuation (restricting high-risk operations after external reads). The authors formally prove a "no persistent worm propagation theorem" under this combination. However, they acknowledge that until RTW-A is widely deployed, existing production agent frameworks are effectively exposed.

Conclusion

This is a present-tense vulnerability, not a future threat. It requires no hacking skill—only an understanding of how agents work and one paragraph of text that an agent decides to save and re-read later. The post closes with an open question: how should the industry educate developers, embed temporal constraints into agent architecture from day one, and make "reading is control" the first principle of security design?

References

1. Zha, M., & Wang, X. (2026). Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense. arXiv:2605.02812. 2. Cohen, Bitton, Nassi. (2024). Here comes the AI worm. arXiv:2403.02817. 3. Zhang et al. (2026). ClawWorm: Self-Propagating Attacks Across LLM Agent Ecosystems. arXiv:2603.15727. 4. Chen et al. (2024). AgentPoison. NeurIPS 2024. 5. Wallace et al. (2024). The instruction hierarchy. arXiv:2404.13208.