An AI email assistant can pass along hostile instructions hidden in material it reads. Morris II, a research demonstration first published in 2024, showed how that behavior could form a chain between connected AI applications.
The researchers were testing a design risk, not reporting a global outbreak. Their work examined assistants built to retrieve information and use generative models while processing email.
The underlying failure is indirect prompt injection. Text supplied as outside content is treated as an instruction to the assistant. A message that should be summarized or searched can instead influence what the system does next.
Morris II adds replication to that problem. The hostile material asks an affected assistant to reproduce the instructions in its output. If another connected assistant processes that output, the same pattern can continue.
The paper evaluates controlled email-assistant environments, including data extraction and propagation. Those results concern the applications and configurations the researchers built and tested. They do not establish that every commercial assistant is vulnerable in the same way.
Calling the experiment zero-click also needs context. A recipient did not need to manually open a malicious attachment in the demonstrated workflow. The surrounding application still had to retrieve the hostile content and grant the model relevant capabilities.
The security boundary is therefore inside the workflow: retrieved material and trusted instructions serve different roles. The research shows what can happen when software lets those roles blur. An ordinary-looking message became an instruction carrier.
