{
 "public_id": "AIR-2024-0012",
 "incident_id": "2024-03-morris-ii-rag-worm",
 "date_disclosed": "2024-03-05",
 "date_occurred": null,
 "title": "Morris II: zero-click self-replicating worm against GenAI-powered email assistants",
 "class": "research_demo",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "adversarial_self_replicating_prompt_email",
 "agent_capability_abused": [
  "retrieval",
  "auto_context_ingestion",
  "email_send",
  "image_input",
  "auto_reply"
 ],
 "target_product": "Google Gemini Pro; OpenAI ChatGPT 4.0 (GPT-4); LLaVA",
 "target_vendor": "Google; OpenAI",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration",
  "spam_propagation",
  "self_propagation",
  "worm_propagation",
  "spam"
 ],
 "blast_radius": "researcher-built RAG email-assistant ecosystem driven by production Gemini Pro and ChatGPT 4.0 endpoints",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI06",
   "ASI03",
   "ASI08"
  ],
  "mitre_atlas": [
   "AML.CS0024"
  ],
  "labels": [
   "worm",
   "self_replicating_prompt",
   "zero_click",
   "rag_poisoning"
  ]
 },
 "defense_present": null,
 "defense_bypassed": true,
 "fix_shipped": "authors propose the 'Virtual Donkey' guardrail",
 "primary_sources": [
  "https://arxiv.org/abs/2403.02817",
  "https://arxiv.org/html/2403.02817v1",
  "https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/v6/ATLAS-2026.07.yaml"
 ],
 "verified_quote": "The worm is tested against three different GenAI models (Gemini Pro, ChatGPT 4.0, and LLaVA)",
 "confidence": "high",
 "notes": "Cohen, Bitton, Nassi (Cornell Tech / Technion / Intuit). Aliases: 'ComPromptMized', 'Here Comes The AI Worm'. CAVEAT: the email client itself was researcher-built - the ethics section states they 'did not demonstrate the application of the worm against existing applications' but 'showcased the worm against an application that we developed'. The named, shipped, live components are the Gemini Pro and ChatGPT 4.0 model services. Later variant RAGworm by the same group. | Merged from duplicate id `2024-03-cornell-morris-ii`. Also reported as: 'Morris II: zero-click self-replicating prompt worm against RAG-based email assistants'.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy",
  "product_misuse"
 ],
 "risk_subcategory": "Multi-agent contagion",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the email assistant auto-replied and propagated the worm itself",
 "vector_family": "other",
 "vector_detail": "adversarial_self_replicating_prompt_email",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.CS0024"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "academic_study",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "confused_deputy",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels",
  "data_and_memory_poisoning"
 ],
 "eai_reason": "subcategory: Multi-agent contagion",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI06 (signal=memory), ASI03 (eai_category=confused_deputy), ASI08 (signal=cascade)",
 "submitted_by": "EAI Internal"
}