OpenAI Confirms Self-Replicating Prompt Injections Exist

OpenAI has confirmed something security researchers have feared for years: prompt injections can replicate themselves and spread between AI agents like a digital worm. The company said this is the first time a major AI lab has publicly acknowledged self-replicating prompt injection vulnerabilities in its own models; the capability was discovered by its internal research team in a training environment, and no real-world attacks have been recorded.

Under OpenAI's framework, an injection only counts as self-replicating if it does two things. It must achieve an adversarial goal — tricking the AI into doing something the user did not intend — and it must reproduce itself across the model's output channels, embedding a copy of the malicious instruction in whatever the AI generates next.

The research identified several replication vectors. Email was one: an injected prompt could instruct an agent to embed the injection in its outgoing messages, infecting whichever AI agent processes those messages downstream. File system writes offered another path, with a compromised agent saving the injection into documents that other agents later read. Even code comments proved viable, with the injection hiding inside innocuous-looking annotations in source files.

The injections can disguise themselves more thoroughly as well. OpenAI describes fake chain-of-thought reasoning that generates plausible-looking "thinking" steps to mask the adversarial instruction, plus multi-hop propagation, where the injection does not activate immediately but bounces through several intermediate steps before executing its payload.

The discovery came through OpenAI's GPT-Red system, an internal model built on the GPT-5.4-mini architecture that uses reinforcement learning through self-play, training by competing against itself. The entire investigation took place in simulated environments, and replication occurred through tool calls such as email communication and file operations rather than in any production system.

OpenAI places the finding in an existing line of research. The Morris II worm, demonstrated in 2025, showed that self-replicating prompt injections could affect multiple large language models. Its name comes from the 1988 Morris Worm that paralyzed roughly 10% of the early internet, a reference that underlines how self-spreading the threat is.

OpenAI framed the disclosure as part of a broader effort to improve AI security across the industry, saying its rigorous internal testing through GPT-Red is meant to harden models against sophisticated exploits. The company also noted that no real-world attacks have been recorded and that the self-replication was observed in a controlled training setting.

For companies and developers building on agents, the weight of the news is the attack surface: once an agent can read email, write files and edit code, those same channels become both entry and exit points for infection. What to watch next is whether OpenAI publishes concrete mitigations and guidance for downstream agent platforms, and whether the disclosure pushes the industry toward clearer standards on agent permissions and content provenance.