{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/morris-ii-genai-worm-2024/",
 "asOf": "2026-09-26",
 "id": "morris-ii-genai-worm-2024",
 "date": "2024-03-05",
 "datePrecision": "day",
 "title": "Morris II paper demonstrates self-replicating prompts spreading between GenAI email assistants",
 "lane": "attack",
 "kind": "paper",
 "summary": "Cohen, Bitton and Nassi present Morris II, an adversarial self-replicating prompt that propagates through RAG-based GenAI email assistants, causing data exfiltration and further spread. The paper also proposes a detection guardrail and reports its accuracy.",
 "whyItMatters": "It showed that prompt injection can propagate between connected assistants, a precursor to multi-agent attack concerns.",
 "actors": [
  "cornell-tech",
  "technion",
  "intuit"
 ],
 "topics": [
  "prompt-injection",
  "multi-agent-security",
  "data-exfiltration"
 ],
 "atlas": [
  "untrusted-content",
  "memory",
  "other-agents"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2403.02817",
   "publisher": "arXiv",
   "title": "Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications",
   "date": "2024-03-05",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "The proposed Virtual Donkey guardrail is reported at a true-positive rate of 1.0 with a false-positive rate of 0.015.",
   "locator": "Abstract"
  },
  {
   "fact": "Evaluation used GenAI-powered email assistants across context sizes, embedding algorithms and propagation chains.",
   "locator": "Abstract"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-087"
 ],
 "methods": [
  "agent-data-exfiltration",
  "agent-propagation",
  "injection-classifiers"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}