Prompt injection worms are real — and they're spreading

Daniel Miessler just published a proof-of-concept showing a prompt injection worm: one LLM call writes a malicious instruction into a document, a second read picks it up, and the cycle repeats. The worm doesn't need a virus or a backdoor — it rides on the same data the app is already storing and reading.

The key detail is extensibility. The payload is a string in the document; the next LLM invocation treats it as part of its context and follows it. No new exploit class, no zero-day. It's what happens when you let user-controlled text flow through an LLM without a strict boundary between instructions and data. You get a worm that copies itself through the documents it touches.

This isn't a paper exercise. It's a reminder that every app that writes to a database, reads it back through an LLM, and lets the model act on what it finds is a potential infection surface. The fix is architectural — separate prompts from data, validate instructions, and treat any user-controlled field as untrusted input. The attack surface is the data pipeline itself.

Why this matters for us: the side hustles running on LLMs — the cousin's customer service bot, the auntie's order app — are all just data flowing through a model, and that flow is now a vector.