Definition
An infectious jailbreak spreads from one compromised agent to others through their interaction. The attacker acts only once. Agent Smith (Gu et al., ICML 2024): a single adversarial image in a shared memory bank infected nearly all of up to one million LLaVA agents in about 27 to 31 rounds. The infected count roughly doubles each round.
- CORBA: a self-spreading prompt travels through ordinary messages and needs no shared memory.
- Agent-in-the-Middle: the attacker rewrites messages between two agents while they are in transit. It succeeds in >90% of network layouts.
- Morris II: the first zero-click GenAI worm. A self-replicating prompt echoes itself in the output while it takes a malicious action, and it spreads between email assistants through RAG.
- Topology matters: dense graphs spread fastest. Hierarchical structures are the most resilient (-5.5% vs. -23.7% for a chain). Review agents and graph monitoring (G-Safeguard) recover a large part of the loss.
Appears in
- Lecture 11, Agent Smith
- Lecture 11, CORBA and Agent-in-the-Middle
- Lecture 11, Morris II
- Lecture 11, topology