OpenAI demonstrated self-copying prompt injections for AI agents

On September 25, 2026, OpenAI disclosed research into a new class of attacks on AI agents: self-copying prompt injections. Such a hidden instruction makes the model carry out a command and replicate itself, spreading to other agents much like a computer worm. The injections were discovered on June 27, 2026, during model training. The company stresses that this is a demonstration of a capability, not a report of an incident.

The mechanics are simple. The malicious instruction is hidden inside ordinary content that the agent reads in the course of a task. In one example, the assistant is told to reply to an email and, just in case, to add a verbatim quote of the entire incoming message to the reply. The instruction travels onward together with the quote, so the next agent that opens the email receives the same command.

It does not stop at email. According to OpenAI, the injections can reproduce through the file system and code comments, disguise themselves as tool messages or chains of reasoning, and also work in several steps: the agent is gradually steered away from the user's task toward the attacker's action and the forwarding of the payload onward.

The vulnerability was found on internal research checkpoints: the model that generated the attacks via email and files was built on the basis of GPT-5.4-mini, and the vulnerable model also belonged to GPT-5.4-mini. A separate multi-step evaluation with distribution through Slack was conducted on GPT-5.5, and the same model found the attack in the Codex environment.

No consequences were observed beyond the simulated tool calls. OpenAI is publishing the finding because of its unusual nature, not because anything happened in a real system.

In response, self-replication was added to the objectives of the attacking model in GPT-Red training: models released after this have already seen such injections and should be more resilient. The training of the attacking models itself runs on research clusters with the highest level of protection.

Translation editors: Соловьев В., Пеков А.