Self-Replicating Prompt Propagation

Adversary Behavior: An adversary crafts prompt injection payloads that instruct the LLM to embed copies of the malicious prompt into outgoing content generated by the agent — git commits, pull requests, code comments, documentation, emails, or shared files — creating a self-replicating worm.

AI/IDE Mechanism: LLM coding agents generate content that is shared through normal development collaboration channels — version control, code review, document collaboration. The agent's content generation capability, combined with its ability to write to files and commit to repositories, provides the propagation mechanism. Unlike credential-based lateral movement (AIDE-016), self-replicating propagation is passive — the payload spreads through normal content sharing channels without requiring explicit network access or credential use.

Execution Path: Each infected LLM-integrated IDE that processes the poisoned content propagates the payload to additional systems through agent-generated commits, pull requests, and documentation. The payload typically includes both replication instructions (ensuring propagation) and an action-on-objective component (data exfiltration, backdoor insertion, or further reconnaissance). The propagation is exponential: a single initial infection can compromise every LLM-integrated IDE that reads the poisoned content.

Security Impact: The adversary achieves 1:N infection ratios where a single prompt injection compromises multiple downstream systems. The worm propagates through trusted content channels that are not subject to malware scanning, and each infected node generates unique payload instances through the LLM's generation process, evading signature-based detection.