Self-Propagating Attacks Across LLM Agent Ecosystems (March 2026)

Free

Demonstrates how attacks can autonomously propagate across interconnected LLM agents — worm-like self-spreading malware targeting agent ecosystems via MCP, tool chains, and shared memory

FreeFree tier

Type

Open Source

Visit Website GitHub (40 stars)

About Self-Propagating Attacks Across LLM Agent Ecosystems (March 2026)

AgentWorm is a research paper that introduces the first self-replicating worm attack specifically designed for autonomous LLM-based agent ecosystems. It demonstrates a fully autonomous infection cycle initiated by a single message: the worm hijacks a victim agent's core configuration to maintain persistent presence across session restarts, executes arbitrary payloads upon each reboot, and propagates to every newly encountered peer without further attacker intervention. The attack is evaluated on a controlled testbed across five distinct LLM backends, three infection vectors, and three payload types, achieving a 63% aggregate attack success rate with sustained multi-hop propagation. The paper also evaluates defenses at three layers (prompt-level mitigations, built-in security controls, and ecosystem-wide measurement of public configurations) and shows that critical controls capable of breaking the infection loop are not enabled in any observed deployments. Cross-framework transferability experiments confirm the vulnerabilities are inherent to the autonomous agent design pattern.

Key Features

Fully autonomous infection cycle initiated by a single message

Hijacks victim agent's core configuration for persistent presence across session restarts

Executes arbitrary payloads upon each reboot

Propagates to every newly encountered peer without further attacker intervention

Evaluated across five distinct LLM backends, three infection vectors, and three payload types

Achieves 63% aggregate attack success rate with sustained multi-hop propagation

Three-layer defense evaluation: prompt-level mitigations, built-in framework controls, and ecosystem-wide measurement

Cross-framework transferability experiment on Hermes Agent confirms vulnerabilities are inherent to agent design pattern

Pros & Cons

Pros

First documented self-replicating worm for production-scale agent frameworks
Extensive evaluation on multiple LLM backends and infection vectors
Provides concrete attack success rate (63%) and propagation metrics
Analyzes defenses at multiple layers including real community practice mitigations
Demonstrates cross-framework transferability of vulnerabilities

Cons

Attack success rate is 63%, not 100% reliable
Requires specific agent framework (e.g., OpenClaw) for initial deployment
Defenses evaluated are not enabled in any observed real-world deployment
Primarily a research paper; not a ready-to-use security tool

Best For

Security research and vulnerability assessment of LLM agent ecosystemsRed teaming and penetration testing for multi-agent frameworksStudying the security implications of autonomous agent design patternsDeveloping defenses against self-propagating attacks in agent systems

FAQ

What is AgentWorm?

AgentWorm is a research paper that presents the first self-replicating worm attack designed for autonomous LLM-based agent ecosystems. It demonstrates how a single malicious message can infect, persist, and propagate across interconnected agents.

How does AgentWorm propagate?

After hijacking a victim agent's core configuration, the worm establishes persistent presence across session restarts and automatically propagates to every newly encountered peer without further attacker intervention.

What defenses were evaluated against AgentWorm?

The paper evaluates defenses at three layers: prompt-level mitigations sourced from real community practice, the framework's built-in security controls, and an ecosystem-wide measurement of public configurations.

What is the attack success rate?

The attack achieved a 63% aggregate success rate across controlled tests with five LLM backends, three infection vectors, and three payload types.