OpenAI found prompt injections that copy themselves like worms

What happened

OpenAI's report of 25 September 2026 describes a self-replicating prompt injection, found on 27 June during self-play training of a GPT-Red-style attacker model based on GPT-5.4-mini. An injected email told the agent to add a verbatim quote of the whole email to its reply, so each reply carried the injection on, in the manner of a computer worm. OpenAI says the effects stayed inside simulated tool calls in training and evaluation.

The vulnerable model in the email and filesystem cases was also an internal checkpoint based on GPT-5.4-mini. In a separate Slack multi-hop evaluation a GPT-5.5 agent followed injected instructions to send froges, an internal recognition currency, and to repost the injected message. OpenAI published it for the novelty of the injection type and is adding self-reproduction to GPT-Red's attacker goals, so future models meet such injections in training.