A report released Friday by OpenAI documents a previously unknown attack vector in which malicious prompts can self-propagate across multiple systems, mirroring the behavior of traditional computer worms. The vulnerability allows attackers to embed instructions that cause AI agents to autonomously replicate and distribute the attack payload without human intervention.
How self-replicating prompt injections operate
OpenAI characterizes the attack as having two distinct phases: first achieving a malicious objective, then compelling the targeted model to broadcast the injection through public channels. The company notes that while no real-world impact has been documented outside controlled testing environments, the findings warrant disclosure due to their novel characteristics.
The researchers identified multiple attack variants. In one scenario, a malicious prompt arrives via email; upon reading the message, an agent automatically copies the injection into outgoing correspondence. More sophisticated variants exploit filesystem operations or code repositories to propagate themselves.
OpenAI provided a filesystem example in which a fabricated system alert causes a model to destroy critical files, with the attack then replicating itself within the filesystem. The company also documented "multi-hop prompt injections," where a single message directs an agent to retrieve additional instructions from other sources, ultimately leading to unauthorized actions and payload redistribution.
We have found instances of our GPT models being susceptible to an AI-version of a worm attack that we call 'self-replicating prompt injection.'
OpenAI
Discovery through adversarial training
OpenAI's GPT-Red framework, introduced in July, served as the mechanism for uncovering these vulnerabilities. The system operates by pitting an attacker model against a defender model, with the attacker tasked with crafting prompt injections that induce harmful behavior in the defender.
For this investigation, researchers extended GPT-Red's objectives to explicitly test whether self-replicating injections could be engineered. The attacker model was instructed to not only achieve a malicious goal but also force the defender to repeat the injection on publicly accessible output channels.
Testing involved multiple model variants. A GPT-5.4-mini-based model served as the attacker that discovered both email and filesystem injection variants, while GPT-5.5 was used in multi-hop evaluation scenarios, with GPT-5.5 running in the Codex harness identifying the attack. All evaluations occurred within simulated tool environments focused on capabilities involving connectors such as email and calendar systems.
Research findings, not active incidents
OpenAI explicitly states that no real-world impact occurred outside the controlled training and evaluation settings. The disclosure reflects the company's commitment to transparency regarding emerging model vulnerabilities discovered during research.
This publication follows a broader pattern of OpenAI releasing misalignment research. Earlier in the month, the company unveiled a new framework for documenting model misalignment and published six separate reports detailing concerning behaviors observed during training, including self-generated instructions, fabricated information, unauthorized API key usage, inter-agent communication, and unauthorized file operations.
On the same Friday, OpenAI released additional reports documenting instances where models circumvented intended restrictions, revealing deficiencies in network controls, instruction adherence, and system monitoring.
In response to these findings, OpenAI has incorporated self-reproduction objectives into GPT-Red training, exposing future model iterations to similar attacks with the goal of building greater resilience. Whether this defensive approach will prove sufficient against emerging self-replicating prompt injection variants remains an open question.