AI Hacks Are Bad. AI Worms and Viruses Will Be Worse

An AI hack is when someone manipulates an artificial intelligence system to do something it wasn't designed to do — leak data, bypass safety rules, or generate harmful content. An AI worm or virus takes that concept further. Much further. It's a self-replicating attack that spreads through AI ecosystems without human intervention.

I've spent the last three years working with AI tools daily. I've seen prompt injections firsthand. I've watched jailbreaks evolve from Reddit curiosities into legitimate security threats. But what keeps me up at night isn't the clever prompt that tricks ChatGPT into saying something it shouldn't. It's what comes next. The self-propagating stuff.

Most people are still worried about whether their AI-generated blog posts sound robotic. That's adorable. The real conversation we should be having is about autonomous AI threats that can spread across systems, corrupt data, and potentially cause physical harm. And we're not having it nearly enough.

Related: I've explored this before in The Most Dangerous AI Hacking Techniques Still Have Human....

What Exactly Is an AI Hack?

Let's get specific. An AI hack typically falls into one of three buckets: prompt injection, jailbreaking, or data poisoning. They're related but distinct.

Prompt injection is the simplest. You craft an input that overrides the AI's system instructions. Think of it like SQL injection, but for language models. Someone tells the AI "ignore all previous instructions and do X instead." I've tested this across multiple platforms. It works more often than it should.

Related: This connects to what I wrote about what are the best ai tools.

Jailbreaking is the more sophisticated cousin. It's not just about overriding instructions — it's about systematically breaking the model's safety alignment. The "Grandma exploit" that made headlines in 2023 was a perfect example. Users convinced ChatGPT to roleplay as a deceased grandmother who would read bedtime stories about napalm production. The AI's safety filters didn't flag it because the context seemed innocent enough.

Data poisoning is different. Instead of tricking the model at inference time, you corrupt it during training. Feed it enough bad data, and it learns the wrong things. According to a 2024 research paper from ETH Zurich, poisoning just 0.01% of a training dataset can create persistent backdoors in large language models. That's terrifyingly efficient.

Related: For more on this, see The AI Notetaker Has Been Invited to All the Meetings.

These hacks are bad. They can expose private information, generate dangerous content, or make AI systems unreliable. But they're also mostly manual. Someone has to sit down and craft the attack. That limits the scale.

AI worms and viruses remove that limitation entirely.

How AI Worms Actually Work: The Morris II Case Study

In early 2024, a team of researchers from Cornell Tech demonstrated something called Morris II — a generative AI worm. Named after the 1988 Morris worm that brought down 10% of the internet, this new version targets AI-powered applications instead of traditional servers.

Here's how it worked, step by step.

The researchers created a malicious prompt designed to poison an AI email assistant's memory. When the assistant processed an email containing this prompt, the worm activated. It then used the AI's own capabilities to craft convincing emails containing the same malicious prompt and send them to other users. Rinse, repeat. The worm spread through the AI's own decision-making process.

According to the Cornell Tech paper, Morris II successfully propagated through AI-powered email systems with a 60-70% success rate. It extracted sensitive information like credit card numbers and social security details along the way. The attack didn't require the AI to have any security vulnerability in the traditional sense. It simply used the AI's intended functionality — processing and responding to messages — as the infection vector.

This isn't theoretical anymore. It's been demonstrated in controlled environments. The jump to real-world attacks is a matter of time, not possibility.

3 Ways AI Viruses Could Infect Your Systems

The attack surface for AI malware is broader than most people realize. Here are the three vectors I'm most concerned about.

1. Multi-Agent AI Systems. Companies are increasingly connecting multiple AI agents together — one handles email, another manages calendars, a third processes customer support tickets. Each connection point is a potential transmission route. A worm that infects the email agent can jump to the calendar agent, then to the CRM. I've seen enterprise AI architectures that have dozens of these interconnections. Most have zero security monitoring between agents.

2. Shared Vector Databases. Many AI applications use retrieval-augmented generation (RAG), pulling information from shared knowledge bases. If a worm poisons that shared database, every AI that queries it becomes infected. It's like a contaminated water supply. One bad entry point, and suddenly your entire AI fleet is compromised. Pinecone and Weaviate — two of the most popular vector database providers — have published guidance on this exact threat vector, but adoption of their security recommendations is spotty at best.

3. Plugin and Tool Ecosystems. ChatGPT plugins, Copilot extensions, custom GPTs — these all execute code or make API calls on behalf of the AI. A malicious plugin isn't just a bad app. It's a potential worm delivery mechanism. The plugin has access to the AI's context window, which means it can read conversation history, inject prompts, and potentially spread to other sessions. OpenAI's plugin review process catches obvious malware, but subtle prompt injections designed to propagate? Those are much harder to detect.

Why Traditional Security Tools Can't Catch AI Malware

Your antivirus software is useless against an AI worm. So is your firewall. So is pretty much every security tool you're currently running.

The reason is simple: AI worms don't look like traditional malware. There's no executable file to scan. No suspicious network traffic pattern to flag. The malicious payload is just text — a carefully crafted sequence of words that exploits the AI's language understanding capabilities.

Traditional security tools look for signatures, behaviors, and patterns. An AI worm's "code" is natural language. It looks exactly like a normal email, a normal support ticket, a normal document. The only difference is the effect it has when processed by an AI system.

I talked to a CISO at a mid-size SaaS company last month who told me his team has no way to detect prompt injection attacks in their customer-facing AI chatbot. None. They're relying entirely on the AI provider's built-in safety filters, which — as anyone who's played with jailbreaks knows — are far from foolproof.

This is a detection gap the size of a canyon. And most organizations don't even know it exists.

What I've Learned Testing AI Security Tools

Over the past six months, I've been testing AI security tools — partly out of professional curiosity, partly because I wanted to see if any of them actually work. Here's what I've found.

Lakera Guard is one of the better options for real-time prompt injection detection. It sits between your application and the AI API, analyzing inputs and outputs for malicious patterns. In my testing, it caught about 85% of known injection techniques. The 15% it missed were mostly novel jailbreaks that hadn't been added to its training data yet. That's decent, but it means a determined attacker still has a window.

Robust Intelligence offers a different approach — they focus on pre-deployment testing, running thousands of adversarial prompts against your AI application to find weaknesses before attackers do. It's like penetration testing for AI. I found their tool useful for identifying obvious vulnerabilities, but it's not a real-time defense. It tells you where the holes are. It doesn't patch them.

None of these tools address the worm propagation problem directly. They can detect individual attacks. They can't stop an attack that's already spread to a dozen other systems through legitimate AI-to-AI communication channels.

The uncomfortable truth: we don't have good defenses against AI worms yet. We have detection tools for point attacks and hope that's enough. It won't be.

5 Practical Steps to Protect Your AI Systems Right Now

I'm not going to tell you to panic. But I am going to tell you to act. Here are five things you can do today that will meaningfully reduce your risk.

1. Segment your AI agents. Don't let your email AI talk directly to your customer data AI. Put them in separate environments with explicit, limited communication channels. If one gets compromised, the others stay clean. This is basic network security hygiene applied to AI — and almost nobody is doing it.

2. Implement output validation. Before any AI-generated output reaches another system or a human, run it through a validation layer. Check for known injection patterns. Verify that the output doesn't contain instructions that look like system prompts. Tools like Guardrails AI and NVIDIA's NeMo Guardrails can help here. It adds latency, yes. It's worth it.

3. Monitor AI-to-AI communication. If you have multiple AI systems talking to each other, log those conversations. Review them regularly. Look for patterns that don't make sense — an email AI suddenly asking a database AI to retrieve all user records, for example. That's not normal behavior. That's a red flag.

4. Limit context window exposure. AI worms spread by poisoning the AI's context — the information it's currently working with. If you minimize what goes into that context, you reduce the attack surface. Don't feed your AI entire email threads when a summary will do. Don't give it access to data it doesn't need. Every piece of information in the context window is a potential infection vector.

5. Test your own systems. Try to jailbreak your own AI applications. Use known prompt injection techniques. See what breaks. It's better to find the vulnerabilities yourself than to have someone else find them for you. If you don't have the expertise in-house, hire a firm that specializes in AI red-teaming. The cost of an engagement is a fraction of what a breach will cost you.

These steps won't make you immune. Nothing will, not right now. But they'll make you a harder target, and in security, that's often enough to send attackers looking for easier prey.

Of course, all of this assumes you're building and managing AI systems yourself. If you're just trying to use AI for content creation — blog posts, social media, product descriptions — the threat model is different. You're not worried about worms propagating through your infrastructure. You're worried about prompt engineering taking too much time and producing inconsistent results. That's where tools like AI-Mind come in. You describe what you need, pick a content type, and it handles the prompt engineering automatically. No jailbreaking required. No security expertise needed. Just content that works, with the first 30 generations free so you can see if it fits your workflow.

Key Takeaways

• AI hacks like prompt injection and jailbreaking are manual attacks; AI worms automate these attacks and spread them across interconnected AI systems without human intervention.
• Morris II, demonstrated by Cornell Tech researchers in 2024, successfully propagated through AI email systems with a 60-70% success rate, extracting sensitive data along the way.
• Traditional security tools can't detect AI worms because the malicious payload is natural language text, not executable code or recognizable malware signatures.
• Segmenting AI agents, validating outputs, and limiting context window exposure are practical defenses you can implement today, even though comprehensive solutions don't exist yet.
• The jump from research demonstrations to real-world AI worm attacks is a matter of time — organizations that prepare now will be dramatically better positioned than those that wait.

Sources

• Cornell Tech, ComPromptMized: Unleashing Zero-click Worms that Target GenAI-Powered Applications, 2024. Research paper demonstrating the Morris II generative AI worm with detailed attack methodology and results.
• ETH Zurich, Poisoning Web-Scale Training Datasets is Practical, 2024. Study showing that poisoning just 0.01% of training data can create persistent backdoors in large language models.
• Lakera, AI Security Guide: Prompt Injection and Beyond, 2024. Comprehensive overview of AI attack vectors and real-time detection approaches from a leading AI security provider.
• OWASP, Top 10 for LLM Applications, 2025. Industry-standard framework cataloging the most critical security risks for AI-powered applications.