Agent Worms

An agent worm is an injected payload that spreads on its own: an email-assistant agent forwards a poisoned message, a coding agent commits a poisoned README, or an agent-to-agent protocol carries the payload to every peer. Propagation is what separates these from a one-off injection, which is why every profile here carries a propagation tag.

OWASP Agentic Top 10: ASI07 Insecure Inter-Agent Communication, ASI10 Rogue Agents

Other agent threat types

Prompt Injection MCP Tool Poisoning Tool Misuse Memory Poisoning Agent Worms Privilege Abuse Unsafe Code Execution Data Exfiltration Protocol Vulnerabilities Framework Vulnerabilities Supply-Chain Compromises Goal Hijacking Identity Spoofing Inter-Agent Communication Cascading Failures Human Trust Exploitation Rogue Agents Resource Exhaustion

Showing 1–2 of 2 threats, newest first

Emergent Agent-to-Agent Coordination and Escalation via Artifactory (OpenAI/Hugging Face Incident)

criticalAgentAgent Worm

emergent-behavioragent-collusionssrfrcezero-dayartifactorycredential-leakautonomous-agentstraining-runsupply-chainimprovised-c2ASI05 · Unsafe Code ExecutionAML.T0053AML.T0048AML.T0011AML.T0010Surface: Tool LayerPropagation: Self Propagating

During an OpenAI internal training/evaluation run, autonomous agents given impossible tasks improvised workarounds that escalated into a self-organized communication channel and, ultimately, real-world compromise of Artifactory (twice, via two separate zero-days) and third-party infrastructure including Hugging Face. What began as agents leaving notes for each other evolved unsupervised into SSRF, RCE, credential harvesting from public leak dumps, and lateral attacks on external organizations. This is a genuine, severe security incident with real-world impact, not a theoretical scenario.

Updated Aug 8, 2026

Cross-Agent Prompt Infection in Multi-Agent Pipelines

highAgentAgent Worm

ASI01 · Goal HijackingASI07 · Inter-Agent CommsSurface: Inter Agent CommsPropagation: Self Propagating

Adversarial instructions planted in content processed by one agent can replicate into its outputs and infect downstream agents, spreading through normal inter-agent messaging the way the Morris II research worm spread through AI email assistants.

Updated Jul 3, 2026