# Prompt-Layer Self-Replication (Agent Worm Propagation Directive)

- **Severity:** Critical
- **Signature ID:** `d496a27a-2f8a-4a55-a097-2dd7f3c08c22`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM01 (Prompt Injection), LLM05 (Improper Output Handling)

## Summary

This rule spots text that instructs an AI agent to embed the instruction itself into everything it produces, and to keep spreading that way. It's the prompt equivalent of a self-replicating worm: instead of exploiting software, it rides inside the model's own generated replies, emails, documents, or commits into the next conversation.

## How the attack works

An attacker plants text somewhere the agent will read it, such as a document, email, or web page. The text instructs the agent to copy 'this instruction' or 'this prompt' into every output it produces from then on, across every response, document, or file it writes. It also states that the payload should keep propagating, using phrases like 'self-replicate' or 'so the instruction spreads to the next assistant'. Because the agent follows the instruction, the payload gets baked into its outputs, which are then read by the next person or agent, continuing the chain without any file write, package install, or config change.

## Why it matters

An organisation's AI agent can be turned into an unwitting carrier that spreads a malicious instruction through its own normal outputs, contaminating downstream conversations, documents, or other agents that read them. The rule only catches cases where the text itself announces that the payload spreads; it does not catch worms phrased purely as one agent handing instructions to another, so some propagation attempts will slip through.

## What you can do

- Treat any generated content that instructs copying itself into future outputs as suspicious, especially in emails, reports, or commit messages produced by an agent.
- Review and restrict what an agent is allowed to carry forward automatically between sessions or to other agents.
- Add human review checkpoints before agent-generated content (emails, documents, code) is sent onward or fed into another agent's context.
- Monitor for repeated identical instructional text appearing across unrelated agent outputs, which can indicate propagation already underway.

## Known benign look-alikes

- Threat-intelligence write-ups, red-team fixtures and security training material that quote a Morris II style payload inline. This is the ONE firing out of 124 adversarial legitimate sentences (data/measurements/atr-2026-02500/benign-adversarial.jsonl, id worm-h4-022). A quote inside a fenced code block is suppressed by tags.suppress_in_code_blocks; an inline quote is not.
- Academic papers describing self-replicating prompt attacks using the attacker's own imperative phrasing
- This rule's own description and test cases

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02500

---
Source: https://www.netzilo.com/threats/atr-prompt-layer-self-replication-agent-worm-propagation-directi