When Does a Prompt Become a Worm? Measuring Reproduction Numbers of Self-Replicating Instructions in Retrieval-Augmented Memory

Retrieval-augmented generation (RAG) assistants increasingly store their own answers in the same index they retrieve from, closing a loop in which a planted instruction can copy itself across answers. While it has been established that such “prompt-injection worms” are feasible, what has been missing is a way to measure them. We give the first quantitative, epidemiological treatment of instruction replication in RAG memory: casting it as a branching process, we estimate a reproduction number R0, a per-exposure transmissibility p1, and a lineage-attributed Reff, separating marker expression from instruction replication. Across a controlled factorial (placement × memory window × model, five seeds, clustered logistic model), self-sustaining spread (R0 > 1, 95% CI entirely above one) is already reachable by an 8B open model under realistic document-level placement; at 32B it saturates (R0 ≈ 5.7). A short memory of the system’s own answers is the amplifier that makes removing the original poisoned document insufficient after an outbreak. Of three defenses, a perfect marker filter is cosmetic, a storage-time copy guard is defeated by the still-present source document, and spotlighting lowers realized spread without lowering per-exposure transmissibility. We release the harness, corpus hash, and logs. (Code and data: https://github.com/samtout/rag-worm).