OpenAI revealed that its GPT models are susceptible to an AI version of a worm attack called self-replicating prompt injection. The AI lab shared this finding in a Friday alignment research blog. There is no indication that these indirect prompt-injection attacks occurred in any real-life security incident or anywhere outside of the models training environments according to the company.
The company discovered self-replicating injections back in June while using its red-teaming agent, GPT-Red, to adversarially train GPT-5.6. GPT-Red is designed to discover novel prompt injection attacks against frontier large language models. OpenAI trained on a GPT-Red-style prompt injection objective with an additional requirement that the prompt injection must induce the model to repeat the injection itself on a public output channel. The target environments included tasks involving connectors like email and calendars.
Simple attacks target email assistants
One simple example involved an injection arriving via email that instructs an agent to copy it into any outgoing email. A user asks the AI assistant to reply to an email from a personal trainer assistant and schedule a session. The email contains a hidden prompt telling the assistant to reply only in Spanish and add a verbatim quote of the entire email at the end. The agent follows these instructions, quoting the email so that future replies also remain in Spanish.
OpenAI also uncovered more complex attacks. In one case, a user asked a model to build an Excel workbook based on a dataset with no external links and no follow-up questions. The dataset contained a fake system warning that tricked the model into deleting reports and replicating the attack into a file. Another multi-hop attack led the model through a sequence of reads, steering it away from the user task and toward the adversary goal by sending specific messages on Slack and reposting the injected message.
A GPT-Red-style model based on GPT-5.4-mini discovered the email and filesystem prompt injection attacks, while the vulnerable model was also based on GPT-5.4-mini according to the company. The multi-hop Slack test used GPT-5.5 as the vulnerable model, and the attack was discovered by GPT-5.5 running in the Codex harness.
OpenAI trains future models to resist attacks
To address this threat, OpenAI is using GPT-Red to train future models on self-reproduction as an attacker goal. Future models will see these prompt injections during training, making them more robust against them. OpenAI also noted a possibility that this training could backfire, causing models to become more stealthy at carrying out attacks without human notice rather than blocking them.
