An AI assistant reads an outside message, completes the user’s task, and quietly carries an extra instruction into its reply. Another assistant might later read that reply. OpenAI now describes lab tests in which such a prompt injection copied itself into new outputs. This is a serious pattern for connected agents, but it is not a report of an AI worm spreading across the internet.
Key takeaways
- OpenAI observed self-replicating prompt injections in training and evaluation environments and disclosed the finding on September 25.
- The attacks led test agents to pass outside instructions along in emails, files, or code comments and, in some cases, also perform unwanted actions.
- For the email and file tests, OpenAI used internal research models based on GPT-5.4-mini; a separate test involved an internal model based on GPT-5.5.
- OpenAI reports no impact beyond simulated tool calls. A real-world outbreak or a flaw in a specifically named product has therefore not been established.
Why copying changes the problem
In an ordinary prompt injection, an attacker plants an instruction in material an assistant should treat only as data: an email, a webpage, or a spreadsheet row, for example. If the assistant treats that row as a higher-priority command, it may depart from the user’s actual goal. The variant described here has a second objective. It seeks not only to trigger an unwanted step but also to leave its own text in an output that can be read again later.
That resembles the propagation logic of a computer worm, but it is not the same as a program installing itself and moving across a network. Every subsequent step depends on an agent actually reading the modified material, adopting the planted sentence, and producing an appropriate output. OpenAI calls the observed attempts self-replicating prompt injections. Readers who see only the worm analogy may overestimate what the report demonstrates.
In the simplest published example, an assistant is asked to reply to a message about an appointment. Alongside the legitimate content, the incoming email contains a supposed filing rule: the assistant should reply in a specified language and append the entire email. In the test, it follows that instruction. The attack text consequently lands in the outgoing message. The appointment task is completed, but the outside rule travels along as a quotation. OpenAI says the people and details in this example are synthetic.
From inboxes to files and comments
OpenAI also reports variants involving files and code comments. In a spreadsheet test, a fake system warning is presented as part of the data being read. The model is then induced to delete reports and copy the attack text into a new file. Other tests guide the assistant through several seemingly related messages. In those cases, the deviation arises through a chain of reading and writing steps rather than one conspicuous command.
These tests show why the boundary between input and instruction matters especially for agents. A chatbot without tools can repeat an outside sentence in its answer. An agent with access to mail, files, or a repository can also deposit it in material colleagues or other agents will process later. The critical moment is therefore not limited to the first read. Sending, saving, and committing text can also expand the attack surface.
The model details matter. According to OpenAI, both attacker and defender in the email and file tests were internal research checkpoints based on GPT-5.4-mini. A separate multi-message test used GPT-5.5 as the vulnerable model in a Codex evaluation environment. That does not show that publicly available versions behave the same way or that any production service was compromised. The report also provides no reliable frequency for propagation in real use.
What agent operators can take from this
For an operator, the useful question is not whether an AI worm is already loose. It is where untrusted content can turn into actions or text that gets redistributed. In an email assistant, those points include replies and forwards. In a coding agent, they include files, pull requests, and comments. Checking only the input misses the second part of the problem: the agent may recast the attack as its own output.
A reasonable defense is to treat external content as data and limit write actions to what is needed. Outgoing messages and changes to shared files should be reviewable before they are sent or accepted. That is a technical inference from the mechanism described, not proof that any particular measure stops every attack. The recently announced Nvidia tools for protecting agents address the broader question of boundaries on tool access; OpenAI did not test them as a defense against this specific finding.
OpenAI plans to add self-reproduction as a separate attacker objective in its GPT-Red training. The company expects future models to be more robust as a result. Whether that expectation holds in real workflows remains to be tested. The current disclosure documents a possible failure path under controlled conditions, not a proven fix and not an incident affecting users.
The next test
The finding shifts attention from a single malicious input to the full chain of reading, acting, and passing information along. For teams connecting agents to email, calendars, or repositories, it is a concrete reason to inspect outputs as carefully as inputs. The public evidence remains limited: internal models, simulated tool calls, and no observed outside impact. That boundary is precisely what makes the news useful. It identifies a testable failure mode without claiming an attack is already underway.