AI worms are coming — and signatures won't stop them

This is a fascinating and genuinely novel attack vector. The researchers have built a worm that exploits the generative AI supply chain, specifically targeting the retrieval-augmented generation (RAG) pipeline.

Technical Breakdown

• The Mechanism: The worm, "Morris II" (named after the original), uses an adversarial self-replicating prompt. It injects a prompt that, when processed by an LLM, triggers the model to output a new prompt that replicates the worm's payload.
• Attack Vector: It targets the RAG pipeline and AI agent memory. The worm doesn't just sit in a prompt; it poisons the context window. When a new user queries the AI, the worm's payload is retrieved from the vector database and executed, allowing it to propagate to new hosts.
• Key TTPs (MITRE-style):
  • Initial Access: Prompt Injection (T1566.001 - Phishing, but via GenAI context).
  • Execution: Exploitation of LLM agent frameworks (e.g., AutoGPT, LangChain) to execute code or exfiltrate data.
  • Persistence: The worm persists within the RAG vector store, surviving reboots and model updates.
• Why Signatures Fail: The worm is polymorphic. Because it uses an LLM to generate the next iteration of the payload, the exact text, encoding, and structure change with every replication. Traditional signature-based detection (matching a hash or string) is useless.

Defense

This shifts the defense paradigm. You can't just block a string. You need runtime behavior monitoring of the LLM agent's actions (e.g., "Why is the model suddenly calling os.system()?"), strict output filtering, and context-aware anomaly detection on the RAG pipeline to spot when a retrieved document is trying to execute a command rather than provide data.

Source: https://www.reversinglabs.com/blog/ai-worms-are-coming