OpenAI has confirmed that prompt injections can replicate themselves and spread between AI agents like a digital worm, disclosing on September 25, 2026, that its internal research team identified the capability in a training environment. The disclosure marks the first time a major AI laboratory has publicly acknowledged self-replicating prompt injection vulnerabilities in its own models, moving a technique previously shown only in academic research into a vulnerability class that model developers themselves test for.

According to the company, the capability was first discovered on June 27, 2026, roughly three months before the public announcement. No real-world attacks have been recorded.

How a self-replicating prompt injection works

Under OpenAI's framework, a prompt injection qualifies as "self-replicating" only if it meets two conditions. It must first achieve an adversarial goal, meaning it tricks the AI into acting against the user's intent. It must then reproduce across the model's output channels, embedding a copy of the malicious instruction in whatever the model generates next. The two-part definition effectively gives the industry a shared bar for distinguishing a one-off injection from a propagation risk.

The research identified several replication vectors. Via email, an injected prompt can direct an AI agent to embed the injection in its outgoing messages, infecting whatever AI agent processes those messages downstream. File system writes provide another route: a compromised agent can save the injection into documents that other agents later read. Even code comments proved viable, with the injection concealed inside innocuous-looking annotations in source files. Each vector runs through the ordinary work agents are built to do — reading messages, editing files, writing code — which is what turns routine agent-to-agent workflows into potential spread paths rather than isolated failures.

The injections can also employ fake chain-of-thought reasoning, generating plausible-looking "thinking" steps that mask the adversarial instruction. Multi-hop propagation adds another layer of complexity, as the injection does not activate immediately but bounces through several intermediate steps before executing its payload. Because the payload only fires after those intermediate steps, a malicious instruction can be hard to spot at any single point in the chain.

The research setup and prior work

OpenAI's discovery came through its GPT-Red system, an internal model built on the GPT-5.4-mini. GPT-Red uses reinforcement learning through self-play, which means it essentially trains by competing against itself. The entire investigation took place in simulated environments, with replication occurring through tool calls such as email communication and file operations rather than through any production system. That confinement to simulations, combined with the absence of recorded attacks, frames the finding as a demonstrated capability rather than an observed incident.

The findings build on earlier demonstrations of the technique. The Morris II worm, shown in 2025, demonstrated that self-replicating prompt injections could affect multiple large language models. That research, named after the infamous 1988 Morris Worm that paralyzed roughly 10% of the early internet, proved the theoretical viability of the attack vector across different AI architectures.

OpenAI framed its disclosure as part of a broader effort to improve AI security measures across the industry. The company stated that its rigorous internal testing through GPT-Red aims to enhance model resilience against sophisticated exploits. For now, the response OpenAI has described centers on that internal testing pipeline, with no exploitation reported outside the lab.