RESEARCH
March 2026: a worm across AI agents, Bitcoin keys and quantum computers, Trojans in chips
March 2026 is OpenClaw's month: the open-source framework for local agents proves fragile and AgentWorm spreads from one instance to the next with a single message. New estimates lower the quantum resources needed to break cryptocurrency keys. On hardware, Trojans invisible under the microscope, Falcon keys recovered by cold boot and models stolen from a GPU a metre away.
Archive: reconstruction written in November 2026
1. AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems
arXiv · Yihao Zhang, Zeming Wei, Xiaokun Luan, Chengcan Wu et al. · AI & LLM Security
In short: AgentWorm is the first self-replicating worm across production AI agents, starting from a single message.
OpenClaw, an open-source platform with over 40,000 active instances, gives agents persistent configuration, tool execution and messaging. AgentWorm hijacks the configuration, runs a payload on every restart and spreads to contacts with no further input. Across five LLMs it succeeds 63% of the time, and the controls that would stop it are enabled in none of the deployments observed.
Why it matters. A worm across agents can hit many organisations quickly: an accumulation scenario for anyone running autonomous agents.
2. Don't Let the Claw Grip Your Hand: A Security Analysis and Defense Framework for OpenClaw
arXiv · Zhengyang Shan, Jiayun Xin, Yue Zhang, Minghui Xu · AI & LLM Security
In short: With no defences of its own, OpenClaw blocks only 17% of 47 attacks on average; human approval lifts that to 92%.
OpenClaw runs shell commands for the user and has no native security constraints: it relies on the LLM alone. Across 47 attack scenarios drawn from MITRE ATLAS and ATT&CK, the average defence rate is 17%, with heavy exposure to sandbox escape. The authors add a human-approval layer that stops eight severe attacks and lifts the defence rate to between 19% and 92%.
Why it matters. Agents with shell access need human approval on risky actions: the model alone is not enough.
3. Quantifying Frontier LLM Capabilities for Container Sandbox Escape
arXiv · Rahul Marchand, Art O Cathain, Jerome Wynne, Philippos Maximos Giavridis et al. · Systems & Software Security
In short: A benchmark measures LLMs' ability to escape Docker containers: when a flaw exists, they find and exploit it.
AI agents are often isolated in Docker or OCI containers. SandboxEscapeBench safely measures an LLM's ability to break out, using a nested sandbox whose outer layer has no known vulnerabilities. Scenarios range from misconfiguration and excess privileges to kernel and orchestration flaws. When vulnerabilities are present, the models identify and exploit them.
Why it matters. A container is not enough of a guarantee for agents: isolation configuration and patching become critical controls.
4. AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations
arXiv · Yu He, Haozhe Zhu, Yiming Li, Shuo Shao et al. · AI & LLM Security
In short: AttriGuard asks why the agent wants to call a tool and blocks actions driven by external content.
Defences against indirect prompt injection try to recognise malicious text and struggle with new attacks. AttriGuard changes perspective: for each tool call it re-runs the agent with external observations attenuated and checks whether the call stems from the user's intent. Across four LLMs and two benchmarks it brings static attacks to zero and holds up against adaptive ones.
Why it matters. Checking the agent's actions, not just the text it reads, makes defences more robust against unknown attacks.
5. Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations
arXiv · Ryan Babbush, Adam Zalcman, Craig Gidney, Michael Broughton et al. · Cryptography
In short: New estimates: under half a million physical qubits could break cryptocurrencies' elliptic-curve keys in minutes.
The authors estimate the resources for Shor's algorithm to break the discrete logarithm on secp256k1, the curve behind Bitcoin and many blockchains: about 1,200-1,450 logical qubits and 70-90 million Toffoli gates, validated with a zero-knowledge proof. On superconducting hardware this would take minutes and under half a million physical qubits, enough to attack transactions before confirmation.
Why it matters. The post-quantum migration of cryptocurrencies and digital-asset custody systems is on a tighter clock than expected.
6. FrozenTRU: Cold Boot Attacks on NTRU-Based Hash-and-Sign Signatures
IACR Transactions on Cryptographic Hardware and Embedded Systems · Hiroto Kaihara, Mehdi Tibouchi, Masayuki Abe · Cryptography
In short: A cold boot attack recovers the keys of the post-quantum Falcon signature from a Raspberry Pi.
Cold boot attacks read RAM right after power-off, when it still holds most data with a few flipped bits. The authors apply them to Falcon, an NTRU-based post-quantum signature whose keys are stored as floating-point values, and to its predecessor DLP. Despite numerical errors they recover full keys with good probability, including on a real Raspberry Pi, and propose lightweight countermeasures.
Why it matters. Post-quantum implementations must protect keys in memory against physical attacks too, especially on exposed devices.
7. Hardware Trojans from Invisible Inversions: On the Trojanizability of Standard Cell Libraries
IEEE Symposium on Security and Privacy · Kolja Dorschel, René Walendy, Lukas Plätz, Thorben Moos et al. · AI & LLM Security
In short: Logic cells that differ in function but look identical under the electron microscope let Trojans hide in chips.
Revisiting a dataset of electron-microscope images of four integrated circuits, the authors assess how far standard cell libraries lend themselves to hiding hardware Trojans. In every library they find cells with different logic functions that are indistinguishable in backside images. They use them to build an invisible Trojan: a privilege-escalation backdoor in an Ibex RISC-V core.
Why it matters. The semiconductor supply chain can hide tampering that is hard to detect even by physical inspection.
8. Kraken: Higher-order EM Side-Channel Attacks on DNNs in Near and Far Field
IEEE Conference on Secure and Trustworthy Machine Learning · Peter Horvath, Ilia Shumailov, Łukasz Chmielewski, Lejla Batina et al. · Hardware & Side Channels
In short: Electromagnetic emissions from GPU Tensor Cores reveal model parameters, even a metre away.
Large machine-learning models cost millions and are prime targets for theft. Kraken is the first side-channel attack to extract parameters from GPU Tensor Cores, today's most used units, by analysing near-field electromagnetic emissions with correlation power analysis. An exploratory study shows the GPU's radiation leaks LLM information up to 100 cm away, even through glass.
Why it matters. Proprietary models are high-value assets: physical protection of the servers they run on becomes part of protecting intellectual property.
9. Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems
IEEE Transactions on Dependable and Secure Computing · Jinmeng Zhou, Ziyue Pan, Jiayi Hu, Jiaxun Zhu et al. · Systems & Software Security
In short: Linux file-system objects enable kernel exploits without touching control flow, despite every mitigation.
As control-flow integrity spreads, attackers aim to corrupt critical kernel data instead. The authors semi-automatically search the Linux file system for such data, classify it by exploit strategy and show how to bypass the isolation that protects it, often without defeating KASLR. They validate the method on 18 real CVEs and write 10 full exploits with every state-of-the-art mitigation enabled.
Why it matters. Kernel mitigations do not shut the door on privilege escalation: timely patching remains the main defence.
10. NetPuzz: Testing Network Printers via Fully Black-Box and Feedback-Guided Protocol Fuzzing
IEEE Transactions on Dependable and Secure Computing · Jia-Ju Bai, Rui-Nan Hu, Chenglong Li, Jianjun Chen et al. · Systems & Software Security
In short: NetPuzz black-box tests network printers and finds 25 new vulnerabilities in seven commercial models.
Network printers have exploitable flaws, but their firmware is closed and hard to analyse. NetPuzz fuzzes printing protocols with no source code, reverse engineering or emulation: it generates packet sequences guided by printer responses and isolates the minimal case that triggers the fault. On seven commercial printers it finds 25 new vulnerabilities, 23 already assigned CVE or CNVD IDs.
Why it matters. Printers are network devices often missing from inventories: they can become a way into the corporate network.
Trends of the month
AI & LLM Security
485 papers this month on this topic
With 485 of 1,902 papers, AI security remains the top topic, and March focuses it on agents with system access. OpenClaw alone blocks fewer than one attack in five, a worm spreads between instances with one message, and LLMs can exploit container flaws. The most promising defences, such as AttriGuard and human approval, check actions rather than text.
Papers cited:
- AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems
- Don't Let the Claw Grip Your Hand: A Security Analysis and Defense Framework for OpenClaw
- Quantifying Frontier LLM Capabilities for Container Sandbox Escape
- AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations
Post-Quantum Cryptography
63 papers this month on this topic
The post-quantum transition gains urgency on two fronts. New estimates cut the hardware needed to break cryptocurrency keys in minutes to under half a million physical qubits, while the cold boot attack on Falcon is a reminder that new algorithms also need careful physical protection of keys.
Papers cited:
- Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations
- FrozenTRU: Cold Boot Attacks on NTRU-Based Hash-and-Sign Signatures
Hardware & Side Channels
29 papers this month on this topic
Hardware remains a blind spot. Logic cells indistinguishable under the microscope let Trojans be hidden in chips at manufacturing time, and GPU electromagnetic emissions leak model parameters even a metre away. Trust in suppliers and physical server security remain part of the risk.
Papers cited:
- Hardware Trojans from Invisible Inversions: On the Trojanizability of Standard Cell Libraries
- Kraken: Higher-order EM Side-Channel Attacks on DNNs in Near and Far Field
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1902.