I am convinced we are on the verge of the first "AI agent worm". This looks like the closest hint of it, though it isn't it quite itself: an attack on a PR agent that got it to set up to install openclaw with full access on 4k machines https://grith.ai/blog/clinejection-when-your-ai-tool-installs-another
But, the agents installed weren't given instructions to *do* anything yet.
Soon they will be. And when they are, the havoc will be massive. Unlike traditional worms, where you're looking for the typically byte-for-byte identical worm embedded in the system, an agent worm can do different, nondeterministic things on every install, and carry out a global action.
I suspect we're months away from seeing the first agent worm, *if* that. There may already be some happening right now in FOSS projects, undetected.
Christine Lemmer-Webber
npub1ur…3v0z4
2026-03-05 18:46:02 UTC
Author Public Key
npub1urx3t48an3pv2vh37akfaks6ty5aujgslfccaa2g4egmam4c2czqg3v0z4Seen on
wss://relay.momostr.pinkPublished at
2026-03-05 18:46:02 UTCEvent JSON
{
"id": "f9842e2a5937ab9ff8e999d871ea4a51e9fbf87533c856e6ef293f08a1baf6c0",
"pubkey": "e0cd15d4fd9c42c532f1f76c9eda1a5929de4910fa718ef548ae51beeeb85604",
"created_at": 1772736362,
"kind": 1,
"tags": [
[
"proxy",
"https://social.coop/@cwebber/116178050263113242",
"web"
],
[
"proxy",
"https://social.coop/users/cwebber/statuses/116178050263113242",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://social.coop/users/cwebber/statuses/116178050263113242",
"pink.momostr"
],
[
"-"
]
],
"content": "I am convinced we are on the verge of the first \"AI agent worm\". This looks like the closest hint of it, though it isn't it quite itself: an attack on a PR agent that got it to set up to install openclaw with full access on 4k machines https://grith.ai/blog/clinejection-when-your-ai-tool-installs-another\n\nBut, the agents installed weren't given instructions to *do* anything yet.\n\nSoon they will be. And when they are, the havoc will be massive. Unlike traditional worms, where you're looking for the typically byte-for-byte identical worm embedded in the system, an agent worm can do different, nondeterministic things on every install, and carry out a global action.\n\nI suspect we're months away from seeing the first agent worm, *if* that. There may already be some happening right now in FOSS projects, undetected.",
"sig": "0a993db223cc0e183e8929c8c8f36c5002eaca7df5ec4aa045719668119c77cd16b4a73fab0c7a7d7cd36bcf4c0c183cc38f92fc33c906d8cc506ae30a45b813"
}