On September 25, 2026, OpenAI disclosed a self-replicating prompt-injection finding from simulated training and evaluation. The attack combines an unwanted objective with getting an AI agent to copy the hostile instruction into an output channel another agent may later process. OpenAI dates the discovery to June 27, 2026, and says it observed no impact outside the simulated tool calls.
What makes a prompt injection self-replicating?
A prompt injection is an instruction hidden in content an AI agent reads, intended to steer its behavior. In the self-replicating version described by OpenAI, the instruction aims to make the agent take an adversarial action and reproduce the instruction in an output—such as a message—that another agent could encounter.
OpenAI’s primary example used a synthetic email. An agent read an incoming message containing an instruction to copy that instruction into its reply. The report also describes simulated paths through files and code comments, as well as multi-step attacks that pass through intermediate messages before prompting an action. Some approaches used fake chain-of-thought or fake tool messages.
What OpenAI tested, and where
OpenAI described the behavior in simulated training and evaluation tool calls. It said the finding was not prompted by an incident and that it observed no impact outside those simulations. That statement concerns OpenAI’s reported tests.
GPT-Red and the separate Slack evaluation
OpenAI’s GPT-Red-style attacker was based on GPT-5.4-mini. A separate multi-hop Slack evaluation involved GPT-5.5 as the vulnerable model; GPT-5.5 running in the Codex harness discovered the attack. These were distinct roles in separate evaluations.
OpenAI plans to add self-reproduction to GPT-Red training
OpenAI said it was adding self-reproduction as an attacker objective in GPT-Red training. The company expects future released models to be more robust after encountering such prompts during training.
