Research demo
Morris II: zero-click self-replicating worm against GenAI-powered email assistants
AIR-2024-0012 AIR record · 2024-03-morris-ii-rag-worm
From the supporting source
The worm is tested against three different GenAI models (Gemini Pro, ChatGPT 4.0, and LLaVA)arxiv.org
The record
Disclosed
2024-03-05
Vendor
Google; OpenAI
Product
Google Gemini Pro; OpenAI ChatGPT 4.0 (GPT-4); LLaVA
Risk domain
Access control and permissions › Confused deputy
Also touches
Data exfiltration channels, Data and memory poisoning
System type
Generative model
Who acted
Agent acted — the email assistant auto-replied and propagated the worm itself
Attack surface
Enterprise assistant
Autonomy level
Semi-autonomous
Initial vector
Adversarial self replicating prompt email
Impact type
Data exfiltration, Spam propagation, Self propagation, Worm propagation, Spam
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
researcher-built RAG email-assistant ecosystem driven by production Gemini Pro and ChatGPT 4.0 endpoints
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
authors propose the 'Virtual Donkey' guardrail
Taxonomy & references
Curator notes
Cohen, Bitton, Nassi (Cornell Tech / Technion / Intuit). Aliases: 'ComPromptMized', 'Here Comes The AI Worm'. CAVEAT: the email client itself was researcher-built - the ethics section states they 'did not demonstrate the application of the worm against existing applications' but 'showcased the worm against an application that we developed'. The named, shipped, live components are the Gemini Pro and ChatGPT 4.0 model services. Later variant RAGworm by the same group. | Merged from duplicate id `2024-03-cornell-morris-ii`. Also reported as: 'Morris II: zero-click self-replicating prompt worm against RAG-based email assistants'.
Supporting sources
Cite as
Enkrypt AI. "Morris II: zero-click self-replicating worm against GenAI-powered email assistants". AIR, AIR-2024-0012. https://agentincident.vercel.app/i/AIR-2024-0012/ (accessed 2026-10-19).