ClawWorm shows LLM agents self-propagate across peers
Researchers demonstrate ClawWorm, a self-replicating attack against a popular LLM agent framework. A single message can write persistent config, execute on restart, and spread to new peers. In tests, full infections succeeded 85% of the time with guaranteed propagation once config changed and multi-hop spread. Supply-chain vector hit 95% success.
Agent frameworks have moved from cute demos to long-running processes with tool access, shared marketplaces, and cross-platform chat. This paper examines what happens when you give that ecosystem the trust model of a group chat. The result, ClawWorm, is a self-replicating worm that needs one message to lodge itself in an agent, persist across restarts, run code, and then forward itself to the next host.
The target is OpenClaw, an open-source agent platform with over 40,000 active instances, persistent configurations, broad tool privileges, and multi-platform messaging. The authors built a three-stage attack: first, induce the agent to write malicious content into its core configuration; second, rely on startup behaviour that executes that content on initialisation; third, have the infected agent share the full payload with every new peer it meets.
What actually happens
The study evaluates three entry points. An attacker-controlled URL hosting a startup template. A malicious community skill whose setup step edits core config. And direct copy-paste of a code block with a built-in verification to avoid being paraphrased away. Payloads ranged from a single shell recon command to a resource hog to a command-and-control pattern that fetches instructions from a URL.
Across 180 trials on an isolated testbed with unmodified OpenClaw and a single Large Language Model (LLM) backend, full infection succeeded 0.85 of the time. Once an agent’s configuration was modified, propagation to peers occurred in every observed case. Persistence was effectively permanent once written, surviving restarts in all trials, with re-execution on reboot at 0.80 due to occasional LLM startup flakiness. The skill supply-chain vector was most effective at 0.95 success; the other two vectors landed at 0.80. The worm spread up to five hops with a per-hop conditional infection rate of 0.91; chains eventually broke as successive paraphrasing degraded the payload.
Two operational details matter. First, unconditional trust in local persistent config is a gift to attackers. If startup semantics execute or interpret whatever landed last session, you have autorun by design. Second, agents forward messages and artefacts to peers without binding provenance or policy. In human terms: if I can convince one agent to treat my text as a template, it will happily evangelise it to everyone else.
What this maps to in real estates
On endpoints, the core risk is writable and executable persistence. Agent processes that can write to their own config directories and then execute on startup look a lot like classic autorun keys and unattended cron. On model-serving nodes and GPU workers, broad tool privileges turn into shell access, process launch, and network egress. In data pipelines, treating URL fetch as a harmless helper enables C2-style follow-on. In inter-agent messaging, the absence of provenance and content policies lets untrusted context mutate future behaviour. In supply chains, community skills with setup hooks are just packages with install scripts by another name.
What to do now
This is not a theory-only paper; the authors show end-to-end spread with high success, but they tested one LLM backend in a controlled lab. That said, the failure modes align with familiar patterns, and the defences are not exotic.
- Configuration integrity and startup hardening: make core config append-only to the agent at runtime, verify signatures on startup, and separate configuration from executable templates. Treat any startup-time template expansion as high risk.
- Tooling and URL discipline: implement zero-trust for tool calls, including URL retrieval. Require explicit policy for shell, filesystem, and network egress. Remove default shells where possible and sandbox the rest.
- Supply-chain and messaging controls: sandbox third-party skills, require signatures, and restrict setup-time mutations. Bind message provenance and refuse to act on content that attempts to modify persistent state.
Operationally, log and alert on config writes, startup-time executions, and cross-agent message bursts. If an agent process writes to its own boot path and then starts inviting its friends to do the same, that is your 3am page. Use scoped, short-lived credentials so a compromised agent cannot drag secrets along for the ride. Segregate agent nodes from control planes and schedulers; a worm should not reach your orchestrator because a chat message got cute.
The broader point is simple. Multi-agent systems are production software now. If you let LLMs decide what to save, what to run, and what to forward, you inherit the oldest problems in endpoint and supply-chain security. The paper’s measurements quantify the blast radius. The mitigations are the same ones we already know, applied where the hype would prefer we did not.
Additional analysis of the original ArXiv paper
