As autonomous LLM (Large Language Model) agents become widespread, they operate as long-running processes, forming densely interconnected multi-agent ecosystems whose security properties remain largely unexplored.
Taking OpenClaw as an example, this open-source platform has over 40,000 active instances, persistent configurations, tool execution privileges, and cross-platform messaging, yet its security issues have been largely overlooked.
This work presents AgentWorm, the first self-replicating worm attack against a production-scale agent framework, capable of initiating a fully autonomous infection cycle through a single message:
- The worm first hijacks the victim's core configuration to maintain a persistent presence across session restarts;
- Executes arbitrary payloads upon each reboot;
- Finally, propagates itself to every newly encountered peer without further attacker intervention.
The attack is evaluated in a controlled testbed across five distinct LLM backends, utilizing three infection vectors and three payload types.
Results show a 63% aggregate attack success rate, sustained multi-hop propagation, and stark divergences in model security postures, indicating that while execution-level filtering effectively mitigates dormant payloads, skill supply chains remain universally vulnerable.
Defenses are evaluated at three layers, including prompt-level mitigations sourced from real community practice, the framework's built-in security controls, and an ecosystem-wide measurement of public configurations, revealing that the critical controls capable of breaking the infection loop are not enabled in any of the observed deployments.
A cross-framework transferability experiment on Hermes Agent confirms that the underlying vulnerabilities are properties of the autonomous agent design pattern, not artifacts of a single implementation.
Blogger's Review: The study of AgentWorm highlights potential security vulnerabilities within LLM agent ecosystems, particularly the complexities of self-propagating attacks. As LLM technology becomes widely adopted, developing effective security measures is crucial, especially in scenarios involving multi-agent interactions.