Morris II Worm: RAG-Based Attack

How Morris II Worm Attacks RAG Systems

Morris II Worm attacks matter because retrieval-augmented generation systems do not just read content, they can also amplify it. When a poisoned prompt, document, or knowledge source enters the retrieval layer, the system may surface malicious instructions as if they were trustworthy context, then repeat them across connected assistants or shared corpora.

The danger is propagation. A single compromised artifact can become a repeatable delivery mechanism inside workflows that reuse retrieval results, especially when the same corpus, index, or assistant chain is available to multiple users or services.

Why Retrieval Poisoning Spreads So Easily

RAG pipelines create a trust boundary between source data and model output, and attackers exploit that boundary by hiding instructions in material the system is designed to ingest. The model may follow the malicious content, quote it, transform it, or pass it onward through summaries, tool calls, or downstream agents.

This is why source quality alone is not enough. Defenders have to think about provenance, tenant separation, document-level permissions, and whether retrieved content can influence behavior beyond the user who should see it.

NHIMG’s RAG Security Guide covers source trust, corpus poisoning, and retrieval poisoning in the same control plane that Morris II Worm attacks target.

For readers mapping the attack pattern to broader AI abuse, the MITRE ATLAS Guide is useful because it frames adversarial data poisoning, exfiltration, and agentic attack staging as related technique families.

How Organisations Reduce Exposure

Exposure review starts with the retrieval layer itself: which corpora are indexed, who can write to them, and whether the assistant can retrieve across security boundaries. If untrusted documents, user uploads, or third-party sources can enter the same retrieval path as sensitive internal content, the attack surface expands quickly.

Controls usually begin with restricting retrieval to approved sources, enforcing permission-aware search, and separating sensitive indexes from general knowledge stores. Sanitisation matters, but so does the policy that decides what is allowed to be retrieved in the first place.

The Permission-Aware RAG Guide is directly relevant because it focuses on retrieval-time authorisation, index isolation, and reducing over-sharing before content reaches the model.

When the compromise path involves live credentials, sessions, or delegated access, the State of NHI & AI Agent Breach Report 2026 helps connect RAG abuse to the broader pattern of stolen tokens and lateral movement.

Detection, Containment, and Recovery After Poisoning

Detection is difficult because the malicious payload often looks like ordinary text until the system starts acting on it. That means teams need telemetry on retrieval events, unusual prompt content, repeated instruction patterns, and unexpected cross-corpus propagation.

Containment usually means isolating the poisoned source, revoking write access to the affected corpus, and reviewing whether the assistant emitted sensitive data or tool actions after ingesting the bad content. If the attack spread through shared indexes or downstream agents, post-incident review must include those connected systems, not just the original document store.

For adversary emulation and control validation around these paths, Breach and Attack Simulation (BAS) Guide is a useful companion because it supports safe testing of detection coverage and response logic.

Risk and Threat Considerations

RAG-based worm behavior is dangerous because it combines content poisoning with propagation. A single malicious entry can keep resurfacing through retrieval, repeated summarisation, or assistant-to-assistant sharing, turning one injection point into a broader compromise path.

Failure mechanism: The attacker plants instructions in retrievable content, then relies on the system to treat that content as trusted context and distribute it again across users, tools, or connected assistants.

Impact: Organisations can see repeated exfiltration, corrupted answers, policy bypass, and wider spread into adjacent systems that reuse the same retrieval sources or model workflow.

Practitioner Guidance

What to watch for: Treat retrieval as an access-control problem, not only a content-quality problem. If a source can influence model behavior, it needs ownership, provenance checks, and an explicit decision about who is allowed to retrieve from it.

Governance implication: The safest RAG deployments separate ingest rights from retrieval rights, constrain high-trust sources, and keep shared knowledge bases from becoming an unreviewed propagation channel.

Related resources from NHI Mgmt Group

• Attack Surface Management
• Why do autonomous agents increase the blast radius of a browser-based attack?
• Why do RAG-based assistants create governance problems for IAM teams?
• How should organisations govern RAG-based AI workflows?