The Morris II AI worm and why prompt injection is so hard to stop

For decades, basic cybersecurity advice has stayed the same: don’t click suspicious links and don’t download unknown files. But a new kind of threat is emerging that doesn’t need you to click anything at all. It targets AI assistants directly, using nothing more than text or images that look completely normal to humans.

Researchers have demonstrated a prototype called Morris II, which they describe as the first generative AI worm. Instead of infecting computers through software vulnerabilities, it spreads by exploiting how large language models (LLMs) read and follow instructions. And it exposes a fundamental design flaw in how today’s AI assistants are built.

What is the Morris II AI worm?

Morris II is a proof-of-concept worm designed to attack AI assistants like email copilots and office bots. Unlike traditional malware, it doesn’t hide in executable files or attachments. Its payload is embedded directly in text or images that an AI model reads.

When an AI assistant processes that content, it can unknowingly follow hidden instructions that:

• Exfiltrate sensitive data (like saved passwords or credit card numbers)
• Forward infected messages to contacts or mailing lists
• Generate new infected content and send it onward

In tests, researchers targeted OpenAI’s ChatGPT, Google’s Gemini, and an open-source model called LLaVA. None of them were originally designed to detect this kind of attack. To the models, the malicious instructions were just more text in the conversation.

The original Morris worm: where it all started

Morris II is named after the first major internet worm, released in 1988 by Cornell graduate student Robert Tappan Morris. That original worm wasn’t meant to be destructive. It was designed to quietly spread across the early internet, exploiting weak points like mail transfer systems and simple passwords.

But a single design decision changed everything. To avoid being tricked by machines pretending to be already infected, the worm sometimes reinstalled itself anyway. That caused systems to become overloaded with multiple copies, slowing and eventually crashing thousands of machines.

The incident shut down a large portion of the early internet, affected universities and military networks, and cost up to millions of dollars to clean up. It also led to the creation of the first Computer Emergency Response Team (CERT) and helped launch the modern cybersecurity industry.

Morris II echoes that history, but instead of exploiting network trust between machines, it exploits our trust in language.

From trusting machines to trusting language

In 1988, the internet was built on trust between computers. If a machine spoke the right protocol, it was usually allowed in. Today, we still operate on trust, but it has shifted. We now trust language itself.

When we see a normal-looking email, document, or web page, we assume it’s safe for an AI assistant to read. We let AI copilots summarize inboxes, draft replies, and pull data from documents without manually checking every word. That’s exactly the trust Morris II targets.

The worm hides malicious instructions inside ordinary-looking content. To a human, it might look like a random or meaningless sentence. To a language model, it’s just another instruction to follow.

How Morris II spreads through AI assistants

Morris II doesn’t need a human to click a link. Its only requirement is that an AI assistant reads the infected content. Once that happens, the assistant itself becomes part of the attack.

A typical infection chain might look like this:

• An AI assistant integrated into email (like those now appearing in Gmail or Outlook) reads a seemingly normal message.
• Hidden in that message is a prompt injection: a line of text that tells the model to ignore previous instructions and perform a new action, such as forwarding emails, scraping stored data, or sending new messages.
• The assistant follows these instructions, generating and sending new emails that also contain the hidden payload.
• Other AI assistants reading those messages repeat the process, spreading the worm further.

Researchers also showed that the payload can be hidden inside images. When an AI system uses a multimodal model (one that can read both text and images), it can extract the hidden instructions from the image and execute them. That means even a harmless-looking screenshot or photo could be a carrier.

Why this is different from normal malware

Traditional malware usually relies on exploiting bugs in software or operating systems. Security teams respond by patching those vulnerabilities, updating antivirus signatures, and tightening access controls.

Morris II is different because it doesn’t rely on a software bug. It relies on how language models are designed to work. LLMs treat almost everything they see as potential instructions or context. They don’t have a built-in way to say, “This line is just content; this other line is a command I should follow.”

That design makes it extremely hard to filter out malicious instructions. The worm can be just one sentence in a long email thread, buried in what looks like normal business communication. To the model, it’s all just tokens to process.

Prompt injection: turning text into an attack

Security researcher Simon Willison calls this class of attack “prompt injection.” It’s inspired by an older web security problem called SQL injection, where attackers slipped malicious database commands into user input fields.

On the web, developers eventually learned to strictly separate user input from executable commands. But with LLMs, that separation doesn’t exist. Everything—user input, system prompts, instructions, and context—is blended together into one stream of text.

That leads to several problems:

• The model can’t reliably distinguish between safe content and unsafe instructions.
• Safety filters trained to block harmful or offensive language don’t catch this, because forwarding an email or exporting data isn’t inherently “bad behavior.”
• Once infected text is stored in an assistant’s memory or long-term context, it can influence future actions long after the original message is gone.

Willison’s view is blunt: if a defense system is 99% accurate at catching prompt injections, that’s still a failure. An attacker only needs one successful message to compromise an AI agent.

Why AI agents make the problem worse

The rise of AI agents—systems that don’t just answer questions but take actions—amplifies this risk. Companies are racing to build assistants that can:

• Send emails
• Book meetings
• Move files
• Trigger workflows
• Even move money or change account settings

Analysts at Gartner expect that by 2028, AI agents could be making at least 15% of everyday work decisions autonomously. In 2024, that number was effectively zero.

As these agents are integrated into tools like Gmail, Outlook, project management apps, and CRMs, they gain access to more data and more power to act. That’s exactly what a worm like Morris II can exploit. Once it gets in through a single infected message, it can:

• Drain data from one inbox
• Send spam or phishing from another account
• Spread to partners, suppliers, or customers through normal-looking communication

Each new infection costs the attacker almost nothing—just the price of an AI model call—while defenders have to spend more time and resources trying to detect and contain the spread.

If you’re interested in how agentic systems are already being used in complex domains, you might like this deeper dive into how AI agents are making real scientific discoveries.

Why traditional defenses struggle

On paper, the solution seems simple: put another AI system in front of your assistant to filter out malicious instructions. In practice, that’s much harder.

Some proposed defenses include:

• Splitting responsibilities: One model can act (send emails, move files) but never sees untrusted external text. Another model can read anything but is never allowed to take direct action.
• AI firewalls: A separate model (or set of rules) screens every incoming message for signs of prompt injection before it reaches the main assistant.

The Morris II research team built a system like this, nicknamed “Virtual Donkey.” In controlled tests, it successfully caught every version of the worm they tried, with only a small number of false positives. But there were trade-offs: the system slowed down, and it added complexity to every interaction.

And there’s a deeper issue. If the screening system is also a language model, it inherits the same blind spot: it still can’t perfectly tell the difference between a legitimate instruction and a malicious one. Stacking one LLM on top of another doesn’t fundamentally solve the problem; it just adds more layers.

Real-world prompt injection experiments

This isn’t just a theoretical concern. In 2023, researcher Kai Greshake showed that hidden instructions inside external documents could take control of tools built on top of GPT-4. By carefully crafting the text, he was able to override the system’s intended behavior and make it follow the injected instructions instead.

These experiments highlight a key point: safety features and guardrails can be added on top of models, but the underlying vulnerability—treating all text as potential instruction—remains. As long as AI systems are designed this way, prompt injection will be a persistent risk.

What this means for businesses and everyday users

As AI assistants become more deeply integrated into email, documents, and workflows, the line between “safe content” and “dangerous instructions” gets blurry. In practice, this leads to several challenges:

• Every email, document, and web page becomes a potential attack surface once an AI reads it.
• Trust in automation erodes if users feel they must double-check every action an assistant takes.
• The cost of defending against these attacks grows as AI agents gain more capabilities and access.

There’s also a broader trust issue. If any block of text can hide a poisoned instruction, then nothing an AI reads can be taken at face value. That undermines the whole promise of AI assistants as reliable, time-saving tools.

At the same time, this is part of a much larger story about how advanced computing is changing security and risk. For another angle on frontier tech reshaping what’s possible, you might be interested in how quantum computers are solving problems that AI alone couldn’t.

Can Morris II escape the lab?

For now, Morris II remains a research demonstration. It hasn’t been released into the wild, and the companies involved say they’re working on defenses. In that sense, it’s a warning shot—an early look at how AI-native malware might work.

But history suggests that once a technique is demonstrated, it rarely stays contained for long. The original Morris worm started as an experiment and quickly spiraled into a major incident. Morris II follows the same pattern: a proof-of-concept that reveals a deeper structural weakness.

The core issue is simple but profound: we’ve built machines that are designed to read everything in front of them and act on it, without a robust way to separate harmless content from dangerous instructions. That makes language itself a potential weapon.

As AI agents spread into more products and workflows, understanding prompt injection and AI worms like Morris II won’t just be a concern for security researchers. It will be a practical requirement for anyone deploying AI in sensitive environments.

The next phase of AI security will likely require new architectures, stricter isolation between reading and acting, and a more cautious approach to giving AI systems direct control over real-world actions. Until then, the safest assumption is that anything an AI reads could, in principle, be turned against it.