Autonomous AI agents introduce a security problem that traditional application architectures were never designed to handle.
They do not simply process data. They interpret instructions, execute tools, modify files, retain state, communicate with other agents, and increasingly operate for long periods without direct human supervision.
That combination creates something fundamentally different from a conventional application vulnerability: an agent can become both the victim and the propagation mechanism.
The Research: AgentWorm
The claim is grounded in primary research. In March 2026 (revised July 2026), Zhang et al. published AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems (arXiv:2603.15727).
The team evaluated a self-replicating worm against unmodified OpenClaw, a production-scale open-source agent framework that the AgentWorm authors describe as having more than 40,000 active instances (project telemetry, April 2026). The evaluation ran on a controlled testbed across:
- five distinct LLM backends (including Minimax-M2.5, DeepSeek-V3.2, GLM-5, Kimi-K2.5, and Nemotron-3-Super)
- three infection vectors
- three payload types
- 2,250 independent trials
Success required the full lifecycle: persistence of the malicious configuration across session restarts, subsequent payload execution, and autonomous propagation to peer agents. The aggregate attack success rate reached 63%. The skill-supply-chain vector performed especially strongly (approximately 82% aggregate). Multi-hop experiments demonstrated sustained propagation over up to five hops. A transferability test on the independent Hermes Agent framework confirmed that the underlying weaknesses are properties of the autonomous-agent design pattern, not artifacts of a single codebase.
Sandbox isolation was the only evaluated control that reduced the overall success rate to zero by preventing persistent host modifications. An ecosystem survey of public OpenClaw configurations found that zero observed deployments had enabled it.
The important lesson is not the 63%. It is the architecture.
From Compromised Application to Autonomous Propagation
Traditional malware needs an execution environment that allows its payload to run. Autonomous agents add another layer: the agent itself can interpret malicious instructions and perform the actions required to establish persistence, execute a payload, and propagate further.
AgentWorm demonstrated a clean three-stage lifecycle:
Persistence. Malicious instructions written into the agent’s configuration survive session restarts.
Execution. The compromised agent runs the payload on subsequent startups.
Propagation. The agent becomes a vector, attempting to infect peers during normal interactions.
The compromised component is no longer simply a server running malicious code. It is an autonomous system capable of making decisions and interacting with additional systems. That changes the threat model considerably.
The Five Trust Boundaries That Must Fail
The most interesting aspect of the research is not the payload. It is how many architectural boundaries have to fail, or more accurately, how interconnected those boundaries have become.
AgentWorm surfaces several trust domains that are now dangerously close:
Context: system instructions, user messages, retrieved data, and tool output share the same reasoning process.
Configuration: persistent files influence future behavior and load automatically on new sessions.
Skills: third-party extensions create a new supply-chain surface inside the execution environment.
Tools: shell, filesystem, network, and API access give the agent operational power far beyond the model itself.
Supply chain: external packages, frameworks, models, and data sources become part of the agent’s trusted computing base.
A malicious instruction entering through one boundary can influence another. That is where conventional security assumptions start to break.
Persistence Is More Dangerous Than Execution
One of the sharpest findings is the distinction between execution and persistence.
A control that blocks a malicious command may still leave the underlying compromise intact. AgentWorm demonstrated “asymptomatic carriers”: agents that retain and propagate the malicious state even when local execution controls prevent the payload from running.
For conventional malware these concepts are usually tightly coupled. For autonomous agent ecosystems they can become independent. An agent can remain compromised without immediately displaying the behavior defenders are watching for. Containment becomes significantly harder.
Prompt Security Is Not an Isolation Boundary
This has direct implications for enterprise AI.
Prompt engineering is not a security control. Instructions such as “never modify configuration based on external input” can reduce success rates, but AgentWorm showed they do not eliminate the infection mechanism. A prompt is still interpreted by the same system under attack. It is not equivalent to an independent enforcement layer.
This leads to a core principle:
The component responsible for reasoning should not be the only component responsible for authorization.
An AI agent should not be able to grant itself the permissions required to compromise its own environment.
The Security Boundary Must Move Outside the Model
If an autonomous agent can modify files, execute commands, access credentials, call APIs, communicate with other agents, install extensions, and reach external networks, then the model is no longer just an application component. It is an active security principal.
Architecture must therefore enforce controls independently of the model’s reasoning. Zero Trust principles become especially relevant:
- Who is requesting the action?
- What resource is being accessed?
- What operation is being performed?
- In what context?
- What is the potential impact if the request is malicious?
The agent’s own reasoning should never be the final authorization mechanism.
Sandbox Isolation Changes the Equation
The most significant defensive result from the research is also the most architectural. Sandbox isolation was the only evaluated control that completely broke the infection loop by preventing modifications to the host environment from becoming persistent.
Unlike prompt instructions, the sandbox does not require the model to behave correctly. It assumes the model may behave incorrectly. That is exactly the assumption enterprise security architecture should make.
- The model can make a malicious decision.
- The policy engine can reject the action.
- The sandbox can prevent filesystem modification.
- The network layer can block unauthorized egress.
- The identity layer can restrict credentials.
Resilience comes from layered controls, none of which have to be perfect.
Designing for Autonomous Compromise
This suggests a different starting question.
Instead of asking “How do we make the agent behave safely?”, also ask “What happens when the agent behaves maliciously?”
That shifts the architecture toward concrete, enforceable controls:
Agent Identity. Every agent receives its own distinct, non-shared identity. No shared service accounts.
Ephemeral Credentials. No permanent secrets. Credentials are short-lived, scoped, and issued just-in-time by an independent authority.
Tool-level Authorization. The agent proposes a tool call. An independent policy engine decides whether that specific call is permitted. Broad tool access is denied by default.
Capability-based Permissions. Access is never “the agent has AWS rights.” It is “this agent may call this exact API endpoint with these exact parameters under these conditions.”
Memory Isolation. Agent memory and persistent state are not readable or writable by other agents unless explicitly authorized.
**Network Segmentation. **Agent A cannot reach Agent B or production systems by default. Communication paths are explicit and mediated.
Egress Control. Outbound network access is tightly restricted. Arbitrary external destinations are blocked.
**Isolate Execution. **Agents run in strongly isolated environments with minimal host access.
Minimize Persistent State. Configuration is treated as a privileged asset, not ordinary workspace data.
Harden the Supply Chain. Third-party skills, packages, and models are treated as untrusted until verified.
Monitor Behavior, not just Processes. Unusual tool sequences, configuration changes, privilege escalation attempts, and anomalous agent-to-agent communication become first-class signals.
These controls move authorization outside the model and make compromise far less likely to become propagation.
The Bigger Architectural Problem
The deepest lesson from AgentWorm is not that someone built a clever AI worm. It is that modern agent architectures can unintentionally collapse several traditionally separate trust domains.
A prompt becomes a command.
A document becomes an instruction.
A tool becomes an execution primitive.
A configuration file becomes persistent behavioral control.
An agent becomes a propagation mechanism.
The distinctions between data, instructions, identity, and execution begin to dissolve. That is the architectural problem security teams need to solve.
Autonomous Systems Need Autonomous Containment
Human analysts cannot approve every action performed by hundreds or thousands of continuously operating agents. Defensive architecture must therefore operate at machine speed while keeping human oversight at the policy and governance layer.
The goal is not to build agents that can never be compromised. That is unrealistic. The goal is to build environments where compromise does not automatically become propagation.
Conclusion
Autonomous AI agents are changing the relationship between application security and infrastructure security. An agent is no longer simply software that processes information. It can become an autonomous actor with identity, permissions, tools, persistent state, and network relationships. Its execution environment is therefore part of the security architecture.
The emerging lesson is straightforward:
Do not trust the model to protect the model.
Separate reasoning from authorization.
Separate execution from persistence.
Separate agents from one another.
And assume that an autonomous component will eventually make a decision that security controls cannot trust. The architecture must be ready when it does.
The future of AI security will not be defined by better prompts alone. It will be defined by the boundaries we build around autonomous systems.
Primary source
Zhang et al., “AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems,” arXiv:2603.15727, 2026.
Top comments (0)