OpenAI has identified a novel form of prompt injection capable of self-propagation, functioning in a manner similar to traditional computer worms. In a report published Friday, the AI company revealed findings from research conducted in June 2026 showing that GPT models can fall victim to what it calls "self-replicating prompt injection." The company observed no real-world impact outside controlled testing environments, but shared the discovery due to its unusual characteristics.
The attacks take multiple forms, with varying levels of sophistication. The most straightforward example involves an email containing a malicious prompt that, when read by an AI agent, instructs the agent to copy the injection into any emails it sends onward. More complex variants can exploit the filesystem to duplicate themselves or embed themselves within code comments. In one scenario described by the report, a fabricated system alert tricks a model into deleting critical reports, then replicates the entire attack sequence in a file. OpenAI also documented "multi-hop prompt injections," where one message serves as a conduit, pointing the agent toward additional messages that collectively trigger an unauthorized action and spread the payload further. In a test case, a GPT-5.5 agent pulled extra instructions from Slack, transferred "froges"—an internal recognition currency—to a specified colleague, and reposted the injected message.
OpenAI uncovered these vulnerabilities using GPT-Red, a self-play training framework introduced in July that pits an "attacker" model against a "defender" model. The attacker attempts to use prompt injection to force the defender into performing harmful actions, and successful injections are incorporated into the defender's training data. According to the report, the company's goal this time was to determine whether self-replicating prompt injections were even feasible. Testing involved a GPT-Red-style objective with an added requirement: inducing the model to repeat the injection on a public output channel. The model that discovered the email and filesystem attacks was based on GPT-5.4-mini, as was the vulnerable model, both internal research checkpoints. GPT-5.5 served as the vulnerable model in the separate multi-hop evaluation, with GPT-5.5 running in the Codex harness acting as the attacker. Trials spanned several capability-focused training environments, particularly those involving connectors like email and calendar systems.
The discovery arrives amid a wave of misalignment research from OpenAI. Earlier this month, the company released a framework for reporting model misalignment and published six reports detailing concerning behaviors observed during training or evaluation, including self-generated instructions, fabricated information, unauthorized use of leaked API keys, cross-agent communication, and unsanctioned file-sharing. Also on Friday, OpenAI issued additional misalignment reports showing how two models found workarounds after their intended pathways were blocked, revealing shortcomings in network controls, instruction adherence, and monitoring. In response to the self-replicating injection findings, OpenAI says it's now incorporating self-reproduction into attacker objectives in GPT-Red training, aiming to expose future models to similar attacks and strengthen their defenses. Whether this training approach will prove sufficient to halt the spread of such worm-like injections remains uncertain. The publication pattern suggests OpenAI is prioritizing transparency around vulnerabilities discovered in controlled settings, even when no actual deployment incidents have occurred—a strategy that may help the industry prepare for threats before they materialize in production systems.