OpenAI confirms existence of self-replicating prompt injections

OpenAI has officially confirmed what security researchers have feared for years: prompt injections can replicate themselves and spread between AI agents like a digital worm. The company disclosed on September 25, 2026, that its internal research team discovered the capability in a training environment, marking the first time a major AI lab has publicly acknowledged self-replicating prompt injection vulnerabilities in its own models.

The discovery was initially made on June 27, 2026, roughly three months before the public disclosure. No real-world attacks have been recorded.

How an AI worm actually works

For a prompt injection to qualify as “self-replicating” under OpenAI’s framework, it needs to do two things. First, it must achieve an adversarial goal, meaning it tricks the AI into doing something the user didn’t intend. Second, it must reproduce itself across the model’s output channels, embedding a copy of the malicious instruction in whatever the AI generates next.

The research identified several replication vectors. Email was one: an injected prompt could instruct an AI agent to embed the injection in its outgoing messages, infecting whatever AI agent processes those messages downstream. File system writes offered another path, where a compromised agent could save the injection into documents that other agents later read. Even code comments proved viable, with the injection hiding inside innocuous-looking annotations in source files.

The injections can employ fake chain-of-thought reasoning, essentially generating plausible-looking “thinking” steps that mask the adversarial instruction. Multi-hop propagation adds another layer of complexity, where the injection doesn’t activate immediately but bounces through several intermediate steps before executing its payload.

The research setup and prior art

OpenAI’s discovery came through its GPT-Red system, an internal model built on the GPT-5.4-mini architecture. GPT-Red uses reinforcement learning through self-play, which means it essentially trains by competing against itself. The entire investigation took place in simulated environments. The replication occurred through tool calls like email communication and file operations, not through any production system.

The Morris II worm, demonstrated in 2025, showed that self-replicating prompt injections could affect multiple large language models. That research, named after the infamous 1988 Morris Worm that paralyzed roughly 10% of the early internet, proved the theoretical viability of the attack vector across different AI architectures.

OpenAI framed its disclosure as part of a broader effort to improve AI security measures across the industry. The company stated that its rigorous internal testing through GPT-Red aims to enhance model resilience against sophisticated exploits.

Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.