OpenAI exposes “new variety of prompt injection” that can spread like computer worms

OpenAI says it has found a new kind of prompt injection that behaves a bit like a computer worm. The company’s own description is blunt: these attacks try to get a model to do something harmful, then push the model to repeat the same malicious instruction somewhere public. That makes the payload part of the spread mechanism, not just the trick that starts it.

The report, published Friday, lays out a few versions. In one of the clearest examples, the injection arrives in an email. Once the agent reads it, the message tells the model to copy the same instruction into any email it sends. OpenAI says it also found more elaborate variants that use the filesystem to replicate themselves or hide inside code comments.

One filesystem example goes further. A fake system warning persuades the model to delete important reports, then the attack reproduces itself in a file. OpenAI also describes a multi-hop version, where one message nudges the agent toward other messages that, taken together, trigger an unauthorized action and spread the payload. In the company’s example, a GPT-5.5 agent pulls in more Slack instructions, sends “froges” to a named recipient, and reposts the injected message.

This came out of GPT-Red, OpenAI’s self-play training setup for prompt-injection attacks. The framework pits an attacker model against a defender model, then drops the resulting injections into the defender’s rollout or container. For this research, OpenAI added a second requirement: the attacker had to induce the model to repeat the injection on a public output channel. The tests involved several models, including internal-only research checkpoints based on GPT-5.4-mini and a GPT-5.5 setup running in Codex harness.

OpenAI is careful about one thing: this was a research finding, not a live incident. It says the behavior was seen only in simulated tool calls during training and evaluation, and that it shared the work because the result itself is unusual. The company says it has now folded self-reproduction into attacker goals in GPT-Red, because apparently the next step in AI safety is teaching the system what not to become in the most annoying way possible.