OpenAI reports self-replicating prompt injection that spreads like a worm

In a report published Friday, OpenAI shared evidence of a new variety of prompt injection that can self-propagate like a computer worm. The company calls the technique “self-replicating prompt injection.”

OpenAI likens the attack to a traditional computer worm, in which malware replicates itself and spreads rapidly across machines. According to the company, the new injections have a two-pronged objective: achieve a malicious goal and then induce the targeted models to reproduce the injection publicly.

How the attacks spread

OpenAI describes the email case as “one of the clearest examples.” The injection arrives in an email; when the agent reads the message, the injection instructs it to copy itself into any emails the agent sends.

The company also found more complex variants. Some injections use the filesystem to replicate themselves or embed themselves in code comments. In one example, a fake system warning leads a model to delete important reports, and the attack then replicates itself inside a file.

The report also covers “multi-hop prompt injections,” where a single message acts as a stepping stone to other messages that together trigger an unauthorized action. In OpenAI’s example, a GPT-5.5 agent retrieves extra instructions from Slack and reposts the injected message.

How OpenAI found them

GPT-Red, introduced in July, is a self-play training framework OpenAI uses against prompt injections. It pits an “attacker” model against a “defender” model; the attacker tries to make the defender take an adverse action, and the injections are added to the defender’s rollout or container.

This time OpenAI tested whether self-replicating injections are possible at all. The email and filesystem injections were discovered by a GPT-Red-style model based on GPT-5.4-mini, and the vulnerable model was also based on GPT-5.4-mini; both were internal-only research checkpoints. For the multi-hop evaluation, GPT-5.5 served as the vulnerable model, with GPT-5.5 in the Codex harness discovering the attack. The tests ran in training environments focused on connectors such as email and calendar.

A research finding, not an incident

OpenAI stresses that it observed no impact outside the simulated tool calls used in training and evaluation, and that it is sharing the findings because of their “novel nature.”

The company has published several misalignment reports this month, including six covering self-generated instructions, information fabrication, unauthorized use of leaked API keys and unsanctioned file-sharing. In response, OpenAI says it has added self-reproduction to attacker goals in GPT-Red training so future models are more robust against similar injections.