Morris II: zero-click self-replicating GenAI worm (research)

What happened

Researchers built an adversarial self-replicating prompt that, embedded in an email processed by a GenAI email assistant, forces the assistant to perform malicious actions and copy the prompt into outgoing messages, spreading with no user click.

Root cause

GenAI agents acted on instructions embedded in untrusted inputs and could be coerced into reproducing and forwarding those instructions, enabling propagation.

Fix / outcome

Disclosed to OpenAI and Google before publication. A proof of concept only, not seen in the wild.

Sources