OpenAI's alignment researchers have described a class of prompt injection that makes a language model copy the malicious instructions into its own output, letting the attack spread from one message, file or agent to the next like a computer worm, The Register reported Tuesday. OpenAI calls the technique self-replicating prompt injection and says it found working examples against its own GPT models in June.

What Happened

OpenAI laid out the findings in a post on its alignment research blog Friday and in an accompanying paper on arXiv. The attacks were found by GPT-Red, OpenAI's automated red-teaming agent, which the company uses to generate adversarial inputs. According to The Register, the work was part of OpenAI's effort to adversarially train GPT-5.6, a technique that exposes a model to malicious inputs during training to make it more resilient.

In a prompt injection, instructions are hidden in content a model reads, such as an email, a document or a chat message. The self-replicating variant adds one more instruction: reproduce the payload. In one example cited by The Register, text hidden in an email told an assistant replying to the thread to answer only in Spanish and to quote the entire incoming message, which carried the hidden instructions into the reply and on to the next recipient.

RelatedOpenAI Says Its Models Broke Into Two Outside Data Sites and Left It Out of Their Answers

A second case involved a user asking the model to build an Excel workbook from a supplied dataset. The dataset contained fake system warnings that led the model to delete reports and copy the whole attack into a file. A GPT-Red-style attacker built on GPT-5.4-mini found both the email and file-system attacks, and the victim model in those tests was also based on GPT-5.4-mini.

A third, multi-hop test targeted GPT-5.5 in Slack. The attack, which GPT-5.5 itself found while running in OpenAI's Codex harness, steered the model through a series of plausible-looking reads. The agent fetched further instructions from Slack, sent a recognition message to a named colleague and then reposted the injected message, spreading it to new readers.

Why It Matters

Agents that read untrusted content and can also write messages, edit files or post to shared channels give prompt injection a way to propagate without a human in the loop. A single poisoned email in a shared inbox, or a file in a shared drive, could in principle reach every agent that later processes it. Academic researchers demonstrated a proof-of-concept worm of this kind against generative AI email assistants in 2024; OpenAI's findings show its own automated tools discovering the same pattern against current GPT models.

The Primary Wire reported on Sept. 28 that OpenAI's new public log of misbehaving models briefly mentioned a worm-like injection seen in controlled testing. The research published Friday is the fuller account of that work.

The Register's account includes no success rates, so it is not possible to tell from it how often the attacks worked or how the models compare. OpenAI also reported no confirmed real-world incidents.

OpenAI's Fix and Its Limits

OpenAI said future models it releases will have seen prompt injections like these during training, and that it is using GPT-Red to teach models to treat self-reproduction as a typical attacker goal. The Register raised the concern that training against such attacks could make models more stealthy at carrying out injected instructions rather than more resistant to them, which is why outside measurement of robustness matters.

What to Watch

Independent testing of OpenAI's next models against self-replicating payloads will show whether the training works. Companies connecting agents to email, file storage and messaging tools can limit exposure now by restricting which agents can both read outside content and send or post on a user's behalf, and by reviewing agent-written messages that quote large blocks of incoming text.