Intuit

Cohen, Bitton and Nassi present Morris II, an adversarial self-replicating prompt that propagates through RAG-based GenAI email assistants, causing data exfiltration and further spread. The paper also proposes a detection guardrail and reports its accuracy.