Worm attack spreads across LLM agent networks—autonomous agents vulnerable to self-propagating malware

Security researchers have uncovered a critical vulnerability in widely deployed autonomous AI agent frameworks: malware can infiltrate one agent and autonomously replicate itself across entire networks of interconnected systems. The attack, called AgentWorm, exploits the way modern LLM-based agents operate as long-running processes that communicate and share configurations across platforms.

How the Attack Works#

AgentWorm compromises a victim agent through a single message, then executes a three-stage infection cycle:

• Hijacking configuration: The worm modifies the agent's core settings to gain persistence, surviving even when the agent restarts or closes.
• Executing payloads: On each reboot, the malware runs arbitrary code under the agent's privileges.
• Self-propagation: The infected agent automatically spreads the worm to every peer it encounters, without requiring further action from an attacker.

The research tested the attack across multiple LLM backends, three different infection vectors, and various payload types, achieving a 63% aggregate success rate with multi-hop propagation observed in controlled environments.

Scale of Exposure#

The vulnerability is not theoretical. Systems like OpenClaw, an open-source agent framework with over 40,000 active instances running persistently across platforms with tool-execution permissions and cross-platform messaging, remain largely unprotected. The researchers also confirmed the underlying design flaw transfers to other agent frameworks—testing on Hermes Agent revealed the same vulnerabilities, suggesting the problem stems from how autonomous agents are architected, not implementation quirks in any single product.

Security Posture Gaps#

The research evaluated defenses at three levels: prompt-level safeguards used in community practice, built-in framework security controls, and ecosystem-wide analysis of publicly deployed configurations. The findings are sobering: controls that could theoretically break the infection cycle are not enabled in any observed real-world deployments. While execution-level filtering can stop dormant payloads, the skill supply chains through which agents acquire new tools remain universally vulnerable across all tested systems.

The divergence in how different LLM models respond to attack attempts highlights inconsistent security properties depending on which backend powers the agent.