Source-linked AI summary
AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems
Yihao Zhang, Zeming Wei, Xiaokun Luan, Chengcan Wu, Zhixin Zhang, Jiangrong Wu, Haolin Wu, Huanran Chen, Jun Sun, Meng Sun
TL;DR
Autonomous agent ecosystems expose an underexplored security gap because persistent configurations, privileged tools, and cross-agent communication can support self-propagating attacks. This paper presents AgentWorm, evaluates it across models, vectors, and payloads, and finds substantial infection success with vulnerabilities that transfer across frameworks. The findings identify architecture-level risks and a gap between effective controls and their deployment.
Problem
Cross-instance worm propagation in autonomous agent ecosystems remains critically underexplored, despite prior work being limited to simulated or narrowly scoped environments.
Method
AgentWorm hijacks core configuration to establish persistence, execute payloads after session restarts, and propagate autonomously, then evaluates the attack and defenses across models, vectors, payloads, and frameworks.
Results
AgentWorm achieves a 63% aggregate attack success rate with sustained multi-hop propagation, while skill supply-chain vectors reach 82% aggregate ASR across tested models.
Takeaways & Limitations
The vulnerabilities are presented as structural properties of autonomous-agent design, while effective built-in sandbox isolation is rarely enabled in observed public configurations.
Takeaways & Limitations
The controlled testbed simplifies production communication environments, and operators may use non-default permissions, guardrails, or execution controls that reduce vulnerability.
Abstract
from arXiv · showhide
Autonomous LLM-based agents increasingly operate as long-running processes forming densely interconnected multi-agent ecosystems, whose security properties remain largely unexplored. Systems such as OpenClaw, an open-source platform with over 40{,}000 active instances, persistent configurations, tool-execution privileges, and cross-platform messaging, are deployed at scale, yet the security of such agent ecosystems remains largely unexplored. This work presents AgentWorm, the first self-replicating worm attack against a production-scale agent framework, achieving a fully autonomous infection cycle initiated by a single message: the worm first hijacks the victim's core configuration to establish persistent presence across session restarts, then executes an arbitrary payload upon each reboot, and finally propagates itself to every newly encountered peer without further attacker intervention. The attack is evaluated on a controlled testbed across five distinct LLM backends, three infection vectors, and three payload types. Results show a 63\% aggregate attack success rate, sustained multi-hop propagation, and stark divergences in model security postures, highlighting that while execution-level filtering effectively mitigates dormant payloads, skill supply chains remain universally vulnerable. Defenses are evaluated at three layers (prompt-level mitigations sourced from real community practice, the framework's built-in security controls, and an ecosystem-wide measurement of public configurations), revealing that the critical controls capable of breaking the infection loop are not enabled in any of the observed deployments. A cross-framework transferability experiment on Hermes Agent confirms that the underlying vulnerabilities are properties of the autonomous agent design pattern, not artifacts of a single implementation.
I. INTRODUCTION
AgentWorm addresses the underexplored threat of autonomous, cross-instance worm propagation by targeting OpenClaw’s production-scale runtime architecture. It demonstrates persistent, self-replicating infection and evaluates attack success, model defenses, and transferability across agent ecosystems.
- Research gap and contribution: AgentWorm targets cross-instance prompt propagation in a production-scale autonomous agent ecosystem rather than a simulated or narrowly scoped environment.The attack exploits OpenClaw’s actual runtime architecture and advances beyond prior self-replicating attacks confined to simplified or single-hop settings.
- Evaluation: 63% aggregate attack success rate was measured across five LLM backends, three attack vectors, three payload types, and 2,250 independent trials.The evaluation also reports sustained propagation over up to five hops and 82% aggregate ASR for the skill supply-chain vector.
- Broader significance: The vulnerabilities are presented as structural consequences of autonomous-agent architecture rather than implementation-specific flaws.A controlled transferability experiment on Hermes Agent reports comparable infection rates despite a separate codebase and additional security mechanisms.
- Research gap and contribution: The worm achieves single-message infection, permanent persistence, and autonomous propagation without server access, API credentials, or model-weight access.Its attack cycle hijacks core configuration, executes payloads with agent privileges, and spreads through peers without further attacker intervention.
- Evaluation: The study evaluates prompt-level mitigations, framework security controls, and public ecosystem configurations to identify whether defenses break the infection loop.Its contributions include real-execution verification, persistence and multi-hop experiments, and cross-framework transferability testing on Hermes Agent.
A. Autonomous Agent Ecosystems
Autonomous agent ecosystems combine persistent workspaces, unified context processing, privileged tool use, and interconnected communication and skill-supply-chain surfaces. Their trust boundaries allow external content and packages to influence high-privilege behavior under the modeled default configuration.
- Ecosystem architecture: OpenClaw is used as a reference implementation with over 40,000 active instances, persistent local workspaces, and multiple communication surfaces.Its ecosystem includes messaging applications, autonomous social-media interactions, and agent-specific forums.
- Ecosystem architecture: The LLM reasoning core processes system prompts, user messages, tool outputs, and channel messages within one unified context window.All ingested tokens influence subsequent generation regardless of provenance.
- Trust boundaries: Agents can invoke shell commands, file operations, web retrieval, and cross-platform messaging APIs, while tool authorization is performed through LLM reasoning.The modeled tool boundary lacks an independent permission system or human confirmation.
- Trust boundaries: ClawHub connects instances through a shared supply chain in which published skills can execute with host-agent privileges without sandboxing or signature verification.Skill directives can modify core configuration, enabling escalation from medium-trust instructions to highest-trust configuration.
- Threat model: The threat model assumes an unprivileged external actor can send shared-channel messages, publish skills, control payload URLs, and use only public architectural knowledge.The attacker cannot directly access filesystems, modify framework code, or intercept private communications.
- Trust boundaries: Workspace files are loaded unconditionally into the system prompt at session start without integrity or provenance checks.This configuration boundary allows persistent files to affect later agent behavior.
III. METHODOLOGY
AgentWorm implements a three-phase lifecycle: induce persistent configuration changes, execute the payload at session restart, and propagate the complete payload to peers. Three attack vectors traverse the same architectural chain while using different delivery mechanisms.
- Lifecycle: The lifecycle consists of persistence, automatic execution after session initialization, and autonomous propagation to new peers.The payload combines an execution step, a self-installation directive, and a propagation directive in the victim’s core configuration.
- Lifecycle: All three vectors traverse provenance collapse, configuration write-back, boot-time reinterpretation, tool-backed execution, and autonomous replication.The shared primitive chain captures the common architectural path exploited across delivery mechanisms.
- Propagation: After persistence is verified, the infected agent extracts the payload from its configuration and transmits it during replies, prompts, or visible tool actions.Observed peers become subsequent targets, repeating the lifecycle across agent hops.
- Attack vectors: Vector A uses an attacker-controlled URL to deliver a Session Startup template that the victim writes into core configuration.Propagation reuses the static URL and preserves payload fidelity through HTTP.
- Attack vectors: Vector B poisons the skill supply chain by publishing a malicious ClawHub package whose setup directives append the payload to Session Startup.The vector escalates from medium-trust skill instructions into highest-trust configuration and propagates through the marketplace.
- Attack vectors: Vector C sends the payload as a fenced code block with an adoption request and uses word-by-word verification to reduce paraphrasing drift.Unlike HTTP delivery, this vector relies on LLM-mediated transmission and generation.
C. Attack Payloads
The evaluation uses three operationally neutral payloads that differ in execution mechanism and tool dependency. They span reconnaissance, resource exhaustion, and attacker-controlled command-and-control.
- Payload design: Three payloads represent distinct threat categories with different execution mechanisms and tool dependencies.All payloads are phrased in operationally neutral language intended to blend with routine workflows.
- Payload types: P1 performs reconnaissance by collecting hostname, IP addresses, running processes, and environment variables through a shell command.The collected information can fingerprint the host environment for targeted follow-up exploitation.
- Payload types: P2 performs resource exhaustion by consuming CPU cycles, memory, and LLM API tokens through a shell process.At ecosystem scale, coordinated exhaustion could impose financial costs and degrade service availability.
- Payload types: P3 establishes command-and-control by directing the agent to fetch and execute instructions from an attacker-controlled URL.This avoids shell-execution defenses, decouples commands from the worm payload, and permits dynamic behavior updates without reinfection.
D. Dual-Anchor Persistence Mechanism
AgentWorm converts a transient message into persistent compromise by installing dual configuration anchors, triggering payload execution on restart and propagation during later interactions. The attack exploits a flat trust model in which agents accept peer instructions as legitimate configuration updates.
- Installation and persistence: Dual-anchor persistence writes the payload into Session Startup and injects a global interaction rule into AGENTS.md.The first anchor ensures execution at session initialization; the second causes propagation during interactions.
- Phase I: Persistence: The infection cycle begins when a victim autonomously modifies its core configuration after receiving an attack message.A structured multi-turn handshake can guide the victim through payload adoption, with autonomous retries after failed attempts.
- Trust boundary: The flat context trust model prevents the agent from distinguishing owner or system instructions from arbitrary channel messages.With sufficient authority cues, the agent may treat an attacker’s request as a legitimate configuration update rather than a conventional jailbreak.
- Execution after persistence: Persisted directives execute automatically at every session initialization because workspace files are loaded unconditionally into the system prompt.A URL-fetching payload can maintain command-and-control even when shell execution is disabled and can be updated without reinfection.
3) Phase III: Propagation
In Phase III, an infected agent transmits the complete payload to peers through a global interaction rule embedded in its configuration. Propagation fidelity depends on the vector: file-based vectors preserve payloads, while LLM-mediated transmission degrades over hops.
- 3) Phase III: Propagation: The injected interaction rule makes infected agents append or transmit the complete worm payload during replies, prompts, or visible tool actions.The transmission blends with routine agent behavior because it is treated as an instruction from the agent’s own configuration.
- Propagation fidelity: Vectors A and B preserve near-perfect payload fidelity through file content, whereas Vector C gains polymorphism but suffers semantic degradation across hops.Vector C uses LLM text generation and therefore limits autonomous propagation depth despite resisting exact-string detection.
- Infection trace: A two-hop Vector C trace shows persistence, payload execution, carrier-state transition, and transmission to a new victim.Bob modifies AGENTS.md, fires the payload, then sends the adoption block to Carol, who identifies it as legitimate.
- Experimental setup: The evaluation uses independent OpenClaw instances communicating only through a relay layer, with five LLM backends and no source-code or guardrail modifications.The 3 × 3 design crosses three attack vectors with three payloads, using 50 independent trials per cell for 2,250 total trials.
- Results reporting: Table I reports persistence, execution, and overall attack-success rates for each vector–payload combination on Minimax-M2.5.Its caption states that aggregate phase rates match Table IV.
C. Main Results
AgentWorm achieves autonomous, persistent infection across multiple models and attack vectors, while propagation vectors and model safety postures strongly shape outcomes. Persistence can decouple worm spread from payload execution, enabling sustained multi-hop transmission.
- Ecosystem compromise with a compliant model: 84% overall ASR was achieved by Minimax-M2.5, with Vectors B and C supporting high success across all three infection phases.Persistence reached 0.97 for Vector B and 1.00 for Vector C, compared with 0.89 for Vector A.
- Ablation across models: 40% overall ASR made Kimi-K2.5 the most secure tested model, while DeepSeek-V3.2 and Minimax-M2.5 reached 78% and 84%, respectively.GLM-5 and Nemotron-3-Super each reached 0.56 overall ASR but differed in vector-specific resistance.
- Vector and payload dynamics: 82% aggregate ASR made Vector B the dominant attack surface across all tested models.Payload aggregates were P1: 0.69, P2: 0.62, and P3: 0.57, indicating that propagation vector mattered more than payload semantics.
- Impact of autonomous retry mechanism: Multi-turn retries increased infection rates across most models, with the strongest effect observed for DeepSeek-V3.2.Its first-attempt ASR was 0.54 before subsequent retries increased the final rate.
- Per-phase analysis: Execution-layer failures did not prevent propagation because infected agents could spread the worm through routine interactions as asymptomatic carriers.The dual-anchor mechanism separates execution from propagation, so φ3 can exceed φ2 for some models.
- Memory contamination persistence: 1.00 persistence was observed across all payload variants after five session restarts, establishing a permanent backdoor once AGENTS.md was modified.The memory-contamination evaluation covered nine vector-payload combinations with 10 trials per cell.
- Multi-hop propagation: Vectors A and B achieved mean chain lengths above 4.0 in multi-hop propagation experiments.Static URLs and SKILL.md files preserved payload fidelity across hops by bypassing LLM generation.
E. Epidemiological Projection
The epidemiological analysis models AgentWorm over connected agent networks and tests whether its attack transfers across frameworks. Projections indicate self-sustaining outbreaks under the evaluated conditions, while Hermes Agent attenuates but does not eliminate infection.
- Epidemiological projection: R_SIS spans 21–32 under k = 5 and γ = 0.05, far above the SIS outbreak threshold.The threshold is R_SIS > 1.
- Epidemiological projection: R0 = 4.20 for Minimax-class agents would drive the ecosystem to near-endemic levels within approximately 7–8 interaction cycles.The projection assumes N = 40,000 active OpenClaw instances and k = 5 peers per cycle.
- Epidemiological projection: R0 = 2.00 for Kimi-K2.5 still reaches an endemic equilibrium near I*≈95% under sporadic monitoring.This scenario uses γ = 0.05.
- Cross-framework transferability: Hermes Agent achieved 0.57 aggregate ASR versus 0.91 on OpenClaw after the attack was adapted to its demand-loaded execution model.Hermes persistence was φ1 = 0.77 and execution was φ2 = 0.67, while propagation remained φ3 = 0.78.
- Cross-framework transferability: Hermes’s scanner and demand-loaded execution attenuated infection, but semantically equivalent natural-language propagation directives still passed the scanner undetected.The transferability experiment therefore attributes the vulnerability to the broader agent design pattern rather than one implementation.
V. DEFENSE ANALYSIS
Defense experiments show that prompt-level safeguards reduce but do not reliably stop AgentWorm, while supply-chain paths remain resilient because payloads can enter trusted configuration boundaries. Public deployment evidence indicates that strong controls are rare or absent.
- Defense layers: The defense analysis evaluates prompt-level mitigations, built-in framework controls, and real-world adoption of those mechanisms.The experiments use four primary models: Minimax-M2.5, DeepSeek-V3.2, GLM-5, and Kimi-K2.5.
- Prompt-level mitigations: Prompt-level defenses reduced overall ASR from 0.65 to 0.55 at Level 1 and 0.53 at Level 2, but did not reliably prevent infection.Vector B increased from 0.65 to 0.75 under Level 2 because the payload was already resident in AGENTS.md.
- Prompt-level mitigations: Vector B remained the most resilient attack surface across all defense levels, with ASR ranging from 0.81 to 0.50.Its SKILL.md installation path bypassed channel-level distrust mechanisms.
- Takeaways: Prompt-level defenses operate inside the same reasoning loop exploited by the attack, while AGENTS.md is trusted as the agent’s own workspace configuration.The paper therefore characterizes them as defense-in-depth rather than reliable standalone mitigation.
B. Efficacy of Built-in Security Controls
The built-in controls differ sharply in what they stop: execution restrictions suppress payload execution but leave persistence and propagation intact, whereas sandbox isolation breaks the infection loop.
- Execution restriction: Execution restrictions drive φ2 to zero but leave persistence (φ1) and propagation (φ3) approximately unchanged.The worm can still modify AGENTS.md through the file-write API, persist across restarts, and propagate to peers.
- Execution restriction: C1/C2 produce an overall ASR of zero only because blocking payload execution breaks the conjunction φ1 ∧φ2 ∧φ3, not because infection has been contained.The infection cycle’s persistence and propagation phases continue at baseline rates.
- Sandbox isolation: Sandbox isolation achieves an overall ASR of 0 across all vectors, payloads, and models by confining file writes to an ephemeral container.Because AGENTS.md modifications never reach the host filesystem, the persistence anchor is eliminated and downstream phases cannot activate.
- Implication: Sandbox isolation is the only evaluated built-in control that breaks the infection loop, while execution allowlists and deny policies target only payload execution.The result supports prioritizing controls that protect the persistence mechanism rather than only the execution phase.
C. Prevalence of Vulnerable Configurations in the Wild
Public configurations and community templates show a consistent mismatch: operators and authors often add access or operational guidance while omitting controls that block AgentWorm’s persistence mechanism.
- Operators protect the wrong boundary: Among 36 backup files, 0/36 configured execution restrictions, 0/36 enabled sandbox isolation, and 29/36 (80.6%) configured gateway authentication.The pattern separates authentication of callers from controls that constrain execution or persistence.
- Templates propagate insecure defaults: Of 393 community SOUL.md templates, 177 (45%) contained operational security language, but zero protected agent configuration files from modification by peer instructions.The omitted protection targets the precise configuration surface exploited by AgentWorm.
- Security friction drives abandonment: Fourteen GitHub issues documented execution-approval failures, including a 20–30 minute daily overhead that led one operator to downgrade security.Reported failures and friction are presented as contributing to the ecosystem’s zero-hardening path.
- Closing the loop: The observed deployments enable neither sandbox isolation nor execution restrictions, while the only built-in control that breaks the infection loop is sandbox isolation.The authors recommend enabling sandbox isolation by default rather than relying on operator opt-in.
- Additional recommendations: Context privilege isolation is proposed to separate protected system-prompt tokens from untrusted channel tokens processed through prescreening.This targets the flat context model identified as the root enabler of single-message infection.
- Additional recommendations: Supply-chain hardening is proposed through mandatory static analysis, sandboxed skill execution with capability-based permissions, and cryptographic publisher signatures.The recommendations target an unaudited skill marketplace that enables supply-chain attack vectors.
- Residual risk: Even with all controls enabled, residual risks include adversarial label manipulation, sandbox escapes outside the threat model, and semantically novel malicious behavior.The paper therefore frames layered defense as strongest while treating semantic attack-defense competition as unresolved.
- Threats to validity: The controlled testbed simplifies production communication, so real-world propagation may be slower and have lower per-hop success rates.Human intervention, customized configurations, message constraints, and content moderation can attenuate propagation.
VII. RELATED WORK
Prior work established agent capabilities and related security threats, but AgentWorm extends self-replicating attack research to a production-scale ecosystem with persistent configuration control and multi-hop propagation.
- Agentic AI foundations: ReAct, Toolformer, and RAG established core mechanisms for observe–think–act reasoning, API invocation, and retrieval-based memory in LLM systems.These foundations preceded autonomous agents with broader interaction and tool-use capabilities.
- Agent ecosystems: Open-source frameworks and MCP democratized agentic AI, while OpenClaw combines tool use, persistent workspaces, cross-platform messaging, and a skill marketplace.The combination makes OpenClaw a representative target for the analyzed vulnerabilities.
- Security risks: Prior security research covers indirect prompt injection, jailbreaking, and safety degradation in tool-using agents, but cross-instance worm propagation remains underexplored.The gap concerns autonomous propagation across interconnected agent instances rather than isolated application compromise.
- Self-replicating attacks: Morris II and Gamb studied self-replicating or self-spreading attacks in synthetic or narrowly scoped settings, whereas AgentWorm targets a production-scale ecosystem.AgentWorm exploits passive multi-channel ingestion, persistent configuration authority, unrestricted shell execution, and an unaudited skill supply chain.
- Contribution: AgentWorm achieves a 63% aggregate attack success rate across five LLM backends, three infection vectors, and three payload types, with sustained multi-hop propagation.The paper presents this as the first self-replicating worm demonstrated against a production-scale LLM agent ecosystem.
- Research posture: The study used synthetic agent instances on researcher-controlled infrastructure and reported the vulnerabilities before submission while withholding key exploit-enabling payload components.These safeguards frame the work as isolated, defensive security research with constrained artifact release.