(Credit: Shutterstock / Fizkes)
A trio of researchers have created a computer worm that can manipulate generative AI tools that use OpenAI's ChatGPT-4 and Google's Gemini, causing poisoned AI email assistants to extract personal data and send spam emails in a test environment.
The new "zero-click" AI worm was able to exploit ChatGPT, Gemini, and the open-source AI model LLaVA by deploying an "adversarial self-replicating prompt" via text and image inputs, the researchers found.
"Attackers can insert such prompts into inputs that, when processed by GenAI models, prompt the model to replicate the input as output (replication) and engage in malicious activities (payload)," the research summary states. "Additionally, these inputs compel the agent to deliver them (propagate) to new agents by exploiting the connectivity within the GenAI ecosystem."
This means the worm could be used to conduct phishing attacks, send spam emails, or even spread propaganda, the report suggests.
The findings, first reported by Wired, prove that no software or large language model is necessarily immune to the threat of computer viruses like malware. Researchers hailing from Cornell University, the software firm Intuit, and Israel's Technion created the worm, dubbed "Morris II." It's named after one of the first self-replicating computer worms, the Morris Worm, developed by Cornell student Robert Morris in 1988.
Back in the day, the original Morris worm crashed about 10% of all computers connected to the internet. While that wasn't all that many machines back then, it showed that computer worms can rapidly move between systems without human involvement, hence the term "zero-click worm."
The AI worm creators argue that "bad architecture design" in the generative AI ecosystem allowed them to create the self-replicating malware.
Such AI worms or other viruses could be used in the future to conduct real, large-scale attacks, potentially infecting more generative AI tools and underscoring the need for better security for AI models.
"They appear to have found a way to exploit prompt-injection type vulnerabilities by relying on user input that hasn't been checked or filtered," OpenAI told Wired. The outlet reports that the AI firm, which is currently being sued by Elon Musk and The New York Times for separate reasons, is in the process of making its systems "more resilient."
PCMag has reached out to Google for comment.