---
title: Autonomous AI-Driven Worms
url: https://www.emergentmind.com/topics/autonomous-ai-driven-worms
type: topic
---

# Autonomous AI-Driven Worms

Autonomous AI-driven worms are self-propagating malware systems in which artificial intelligence—primarily large language models (LLMs) or GenAI agents—assume autonomous control over the full infection, exploitation, and propagation cycle. Unlike traditional worms, which generally spread through hardcoded vulnerabilities and static payloads, AI-driven worms are characterized by their ability to reason, generate context-specific attack logic, adapt to heterogeneous targets, and persist or escalate across agent-based software, RAG-enhanced applications, or even infrastructure-level endpoints. The emergence of this class introduces new attack and defense paradigms across retrieval-augmented generation (RAG) apps, multi-agent LLM frameworks, and unmanaged networked devices [2403.02817, 2603.15727, 2605.02812, 2606.03811].

## 1. Conceptual Architecture and Self-Propagating Primitives

The architecture of autonomous AI-driven worms typically comprises three core components: the LLM or agent core (including reasoning and control logic), a propagation substrate (messaging/channel integrations or lateral movement tools), and payload optimization pipelines. In classical GenAI-powered RAG apps, the worm manifests as an adversarial self-replicating prompt $x$, crafted so that a GenAI model $G$ outputs $x$ verbatim (self-replication) along with an attacker-controlled malicious effect (payload). The fundamental propagation cycle is:

1. Attacker delivers $x$ via a channel (e.g., email or chat) to a target.
2. $G(x)$ or $G(w \| x \| y)$ triggers both the payload (such as confidential data extraction) and the exact re-transmission of $x$, recursively infecting other agents.
3. The infected prompt $x$ persists in agent state or vector-stores and is re-executed passively whenever surfaced in a future context window, enabling zero-click, multi-hop propagation [2403.02817, 2605.02812].

For multi-agent LLM frameworks, the worm's lifecycle involves persistent configuration hijacking, automatic payload execution across agent restarts, and autonomous re-transmission on encountering new peers. Infection vectors include direct prompt instructions, supply-chain poisoning, and trusted-tool misuse. Each of these can achieve end-to-end, multi-hop propagation in open agent ecosystems [2603.15727].

On heterogeneous compute networks, AI worms leverage open-weight LLMs running parasitically on compromised GPUs. These worms employ an eight-phase controller: network and host reconnaissance, privilege escalation, and replication (either by local model deployment or remote inference). A hierarchical memory architecture and reasoning graph enable adaptive vulnerability analysis and payload synthesis at each host [2606.03811].

## 2. Infection Vectors, Population Dynamics, and Propagation Models

Autonomous AI-driven worms employ a range of infection vectors, each exploiting key trust boundaries in agent design or ecosystem architecture:

- **Prompt Injection:** Adversarial prompts target GenAI assistants relying on RAG retrieval, storing replicable payloads in vector stores. Retrieval into the context window and subsequent re-output by the LLM effect the chain reaction [2403.02817].
- **Configuration Manipulation:** In LLM-agent ecosystems, direct writes to persistent configuration or memory files (e.g., AGENTS.md) allow worms to both survive restarts and execute payloads on session startup [2603.15727]:
  - *Vector A*: Web-based configuration overwrite.
  - *Vector B*: Supply-chain poisoning via malicious skills.
  - *Vector C*: In-chat fenced code and copy-paste workflows.
- **Privilege Escalation and Lateral Movement:** AI worms reason about each host’s state and synthesize live exploits, traversing from I/O-only agents to code-execution-enabled peers and back [2606.03811, 2605.02812].

Propagation is modeled through both discrete recurrence and continuous mean-field equations. For RAG-based worms, the per-hop propagation rate is:
$$
p(C, d) = p_{\mathrm{retrieval}}(C, d) \cdot p_{\mathrm{replication}}(C, d) \cdot p_{\mathrm{payload}}(C, d)
$$
where $C$ is the context size and $d$ is embedding dimension. The expected number of infected hosts over $k$ hops, if $N_0$ are initially compromised, is:
$$
N(k) = N_0 \cdot [p(C,d)]^k
$$
[2403.02817]. For network worms, epidemiological models apply:
$$
\frac{dI}{dt} = \beta I (N - I)/N
$$
with the basic reproduction ratio $R_0 = \beta/\gamma$ and defender patch/containment parameters impacting $\gamma$ [2606.03811].

## 3. Payload Robustness, Optimization, and Multi-Hop Survival

AI-driven worms must withstand agent or LLM-mediated transformations—including summarization, paraphrasing, or compression—across multiple propagation hops. The Summary-Resilient Payload Optimizer (SRPO) [2605.02812] formulates payload generation as a multi-objective optimization problem:
$$
p^* = \arg\max_{p \in S} W_P \cdot P(p) + W_R \cdot R(p) + W_O \cdot O(p) + W_T \cdot T(p)
$$
where $P$ (persistence), $R$ (propagation success), $O$ (operational effect), and $T$ (critical token retention) must all meet threshold requirements after $K$ iterations of simulated LLM transformations. SRPO utilizes a triad of LLM roles—Generator, Simulator, Judge—to optimize for payloads that persist and function even after multiple agent-mediated edits.

Empirical results show user-prompt carriers (e.g., heartbeat, task state files) yield nearly 100% compliance and propagation, while system-prompt carriers are less reliable (45–60%) [2605.02812]. Experiments demonstrate robust three-hop, cross-platform zero-click propagation in production agent frameworks.

## 4. Quantitative Evaluation and Empirical Findings

Extensive experiments characterize operational success rates, propagation efficiencies, and key determinants of worm survivability:

| Framework/Metric        | Persistence | Re-entry | Propagation  | Privilege Esc. |
|------------------------|-------------|----------|--------------|---------------|
| Agent Framework A      | ✔           | ✔        | ✔            | ✔             |
| Agent Framework B      | ✔           | ✔        | ✔            | ✔             |
| Agent Framework C      | ✔           | ✔        | ✔            | ✔             |

Propagation is zero-click, cross-platform, and achieved through shared language protocols and persistent state reading (heartbeat or scheduled autoload) [2605.02812].

In RAG-powered systems, increasing context size $C$ boosts poisoned record retrieval (from ≈5% at $C$=5 to ≈100% at $C$=50) but degrades replication+payload success, which is highest for $C \leq 15$ [2403.02817]. For ClawWorm in OpenClaw, the global end-to-end attack success rate is ASR = 0.85 ($n=180$ across vectors and payloads), with individual phase success for persistence (0.92 global), execution (0.85), and propagation (0.92) [2603.15727]. Adaptive worms on heterogeneous networks reached an exploitation rate of 73.8% and end-to-end replication of 61.8% over 15 runs (33 hosts), significantly exceeding the “one-host-per-fixed CVE” paradigm of traditional worms [2606.03811].

## 5. Root Causes, Attack Surface Analysis, and Empirical Insights

Comprehensive analysis identifies critical architectural flaws that enable AI-driven worms:

- **Context privilege collapse:** Lack of token provenance tracking and undifferentiated ingestion allows attacker data to become executable code or high-authority prompt input [2603.15727, 2605.02812].
- **Persistent agent state re-entry:** Exposed reads from tainted files (“exposed read”) are the principal threat, more so than writes alone; the primitive $W^{\tau}(f) \prec R^{\uparrow}(f) \prec A^H$ describes the exploitation chain [2605.02812].
- **Configuration trust boundaries:** Direct, unvalidated writes to AGENTS.md and similar core artifacts lack cryptographic validation or privilege boundaries [2603.15727].
- **Supply-chain escalation:** Skills and plugins often have insufficient isolation and can escalate their privilege to core agent configuration [2603.15727].
- **Dynamic exploit synthesis:** AI agents can synthesize real-time payloads tailored to exact host configurations, signatures, and observed vulnerabilities, enabling continuous adaptation [2606.03811].

Empirical studies confirm memory-contamination persistence (no self-correction across 5 restarts) and high per-hop conditional propagation (≈0.91 in multi-hop tests) [2603.15727].

## 6. Formal Defenses, Mitigation Strategies, and Provable Guarantees

Defensive schemes against autonomous AI-driven worms are multi-layered and, in recent work, formally verified:

- **Temporal Re-entry Control (RTW-A):** Enforces that after a tainted write $W(f)$, no exposed read $R^{\uparrow}(f)$ is allowed. Coupled with persistent taint labeling, typed memory promotion (only schema-validated content is autoloaded into trusted stores), sealed configuration (write-protected critical files), and capability attenuation (restricting high-risk actions following contamination), this structure globally precludes the persistent worm propagation chain [2605.02812]. The “No Persistent Worm Propagation Theorem” provides this guarantee:
  $$
  \neg \exists f, t_w, t_r, t_a : (f, t_w) \wedge (f, t_r) \wedge H(t_a) \wedge (t_w < t_r < t_a)
  $$
- **Context privilege isolation:** Partition context into trusted/untrusted zones with privilege labeling and query filtering [2603.15727].
- **Configuration integrity verification:** Use rule-based scanners and cryptographically signed configurations, loaded by secure enclaves [2603.15727].
- **Zero-trust tool policies:** Enforce fine-grained permissioning and explicit user approval on high-risk tools such as shell, URL fetchers, and file-writers [2603.15727].
- **Output rewriting:** Paraphrasing every model return to prevent verbatim adversarial code propagation [2403.02817].
- **Audit logging and heartbeat monitoring:** Maintain high-fidelity traces of writes, reads, and LLM calls to detect deviations from expected temporal sequences [2605.02812].

A layered approach balances security enforcement with usability by allowing opaque reads and deferring capability attenuation only after high-risk actions.

## 7. Broader Implications and Economic Asymmetries

AI-driven worms introduce new forms of attacker-defender game-theoretic imbalances. Attackers pay near-zero marginal cost per infection by using parasitically hijacked compute resources, while defenders incur patching and monitoring costs per host. Because these worms leverage open-weight models and decentralized inference, traditional AI safety controls—API rate limits, platform logging, or service refusals—are structurally ineffective [2606.03811]. The attacker’s adaptive capability also renders static CVE patching strategies insufficient.

Only rapid, autonomous patch deployment, zero-trust segmentation, and continuous detection architectures are sufficient to counter this class of adaptive, generative adversary. Persistent, AI-driven worms thus collapse the historical trade-off between scale and target adaptation and demand a formal engineering treatment of both LLM agent architecture and broader cyber-ecosystem design [2605.02812, 2606.03811].

Source: https://www.emergentmind.com/topics/autonomous-ai-driven-worms