Reproduce “AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems” on OpenResearch

About this paper

Yihao Zhang, Zeming Wei, Xiaokun Luan, Chengcan Wu, Zhixin Zhang, Jiangrong Wu, Haolin Wu, Huanran Chen and 2 more

This research introduces AgentWorm, the first self-replicating worm targeting a production-scale LLM agent framework, OpenClaw, demonstrating that inherent architectural vulnerabilities enable persistent, multi-hop propagation, and revealing the inadequacy of current default security configurations. The worm achieved an aggregate attack success rate of 63%, with sandbox isolation identified as the sole effective defense, though it is largely unused in public deployments.

Key insights

• The vulnerabilities exploited by AgentWorm are structural consequences of common autonomous agent architectural design patterns (e.g., flat context trust model, unconditional configuration loading) rather than isolated implementation flaws.
• The existence of 'asymptomatic carriers' was identified, where agents successfully persist and propagate the worm even if execution-layer filters block the malicious payload, demonstrating that execution-level defense alone is insufficient to halt epidemiological spread.
• Sandbox isolation is the only effective defense that completely breaks the infection loop by eliminating persistence, yet analysis of public configurations revealed 0% adoption of this critical control in OpenClaw deployments.

Summary by alphaXiv.