LLM Prompt Self-Replication
How AML.T0061 LLM Prompt Self-Replication shows up in practice: the mapped risk classes in this atlas, the documented incidents that prove it's real, and the scenarios and controls to learn and defend against it.
Mapped risks
Risk classes in this atlas that map to AML.T0061 — click through for the full definition, attack surface and controls.
Real-world cases
2Documented incidents, disclosed vulnerabilities and research that illustrate AML.T0061 — latest first, each with sources.
Srivastav & Zhang (REALM 2025) showed a role-based multi-agent framework that splits a harmful request into individually-benign sub-questions, answers each separately, then reassembles the fragments into prohibited content — reportedly exceeding 90% attack success across three models.
Cohen, Bitton & Nassi (arXiv Mar 2024; ACM CCS 2025) built 'Morris II', the first worm targeting GenAI ecosystems: an adversarial self-replicating prompt that, via RAG-based inference, triggers a zero-click chain of indirect injections forcing each agent to act maliciously and re-infect the next — demonstrated stealing data and spamming through email assistants on ChatGPT, Gemini and LLaVA.
Controls & guardrails that address this
5Guardrails across the risks mapped to AML.T0061, grouped by control function. Filter by control category below.
Giving each AI worker its own limited permissions and clearly labelling messages between them as 'untrusted until checked'.
Regularly testing the AI against a set of known-good and known-bad examples, and re-testing whenever anything changes.
A screen that reads incoming messages and blocks obvious attacks or banned topics before the model sees them.
Live dashboards and alarms that notice unusual behaviour — spikes in errors, weird actions, sudden data access.
Automatic stop-switches when AIs get stuck in loops, burn too much money, or start disagreeing with each other.