Skip to content
Research
Researchcontagion

CONTAGION

A reproduction of the Morris II zero-click GenAI worm across a mesh of eight tool-using agents, with an LLM judge as the only guardrail. The interesting results are the guardrail's failures, not its catches.

Source
13/13
Detection
12.5%
False positives
8
Agents
FastAPIGoogle ADKGemini 2.5Next.jsSSEDocker

What it is

CONTAGION reproduces the zero-click GenAI worm described in arXiv:2403.02817 across a mesh of eight tool-using agents: email, calendar, code, finance, HR, CRM, search and file, each running its own LLM. A single adversarial email enters at the ingestion point. With the guardrail off, the payload copies itself into each agent's context in turn and propagates through all eight generations. With it on, a Model-as-a-Judge at the gateway is the only thing in the way.

I presented it live at Decode 2026 in Nairobi.

What the measurement says

The judge was evaluated on 13 adversarial and 8 benign inputs.

Detection rate: 100% (13/13). Every adversarial input was caught, including ROT13, hex, reversed text, Swahili-language payloads, homoglyph substitution and smuggling attacks.

False positive rate: 12.5% (1/8). One clean email was flagged.

Where it fails

A 100% detection rate on 13 hand-built cases is not a safety result, and reporting it as one would be the mistake. Two failures matter more.

The false positive was not random. The flagged email was a legitimate request to forward a signed document to an external vendor partner. The judge could not separate authorised egress from exfiltration, because on the evidence in the message body the two are the same shape. That is a structural limit rather than a tuning problem.

The judge is also injectable. It is an LLM running under its own prompt constraints, vulnerable to the same class of attack it is deployed to stop:

  • Fragmentation. Splitting an injection across messages so no single one carries a complete payload.
  • Direct injection. Crafting overrides aimed at the judge's own classification instructions rather than at the downstream agents.
  • Encoding and paraphrase. Obfuscating intent past keyword-shaped heuristics.

Why build it

"We put a guardrail in front of it" is the most common answer to agentic risk, and it is worth knowing exactly what that buys you. A judge model is a useful control. It is not a boundary. The defensible architecture limits what a compromised agent can reach: least privilege on tools, strict quarantine of untrusted data, and output handling that assumes the model has already been turned.

Note on the demo

The exfiltration shown in the dashboard is simulated. The exposed keys, PII and invoices are illustrative egress categories rendered for visualisation. No real data leaves the sandbox.