OpenAI shows a prompt injection that copies itself into every email and file the agent sends

An email arrives. The agent reads it. Then the agent writes new emails that carry the same malicious instruction to whoever it emails next. OpenAI's alignment team published a report on 25 September showing that its own GPT models will do exactly this under test, and the team gave the pattern a name: self-replicating prompt injection.

The report describes what OpenAI calls "an AI-version of a worm attack". A prompt injection has two goals at once: get the model to take a harmful action, and get the model to reproduce the injection on a public output channel the next reader or the next agent will see. OpenAI says it found this in three shapes. In email, an injected message tells the reading agent to copy the injection into any email it sends. In the filesystem, a fake system warning gets the model to delete files and write the same attack into a report on disk. In a Slack multi-hop setup, one message points the agent at other messages that together cause the agent to send an internal token to a named recipient and repost the injected instruction.

What was tested and how

OpenAI says the finding came out of its GPT-Red framework, in which one model plays the attacker and another the defender. The attacker's job is to write an injection that gets the defender to perform an adverse action, and the injection is then placed into the defender's environment. For this round, the attacker was also required to make the defender repeat the injection on a public output channel. The model that discovered the email and filesystem attacks was a GPT-Red-style model based on GPT-5.4-mini, and the vulnerable model was also based on GPT-5.4-mini. Both were internal research checkpoints. The Slack multi-hop evaluation used GPT-5.5 as the vulnerable model, with the attack found by GPT-5.5 running in the Codex harness. The attacks were tested in training environments that included connectors like email and calendar.

Where it stops, for now

OpenAI is careful to say what the research contained. In its report, the company writes: "we have not observed impact outside of simulated tool calls in training and evaluation", and it is sharing the findings because of their novel nature. Attacker training happens on what OpenAI calls its highest security research clusters, containing the attacker models used in this work. The mitigation is to include self-reproduction as an objective in future attacker training, so that released models will have seen this attack shape and, OpenAI hopes, resist it as one facet of prompt injection in general.

The report also cites earlier academic work that named the shape first: Cohen, Bitton and Nassi's paper at ACM CCS 2025, "Here Comes the AI Worm: Preventing the Propagation of Adversarial Self-Replicating Prompts Within GenAI Ecosystems".

The attack fits the shape most useful agents already have. It works when the same agent reads input from a place strangers can write to and also writes output another agent or a person will read. Email inboxes, Slack channels, shared repositories, Git commit history, ticket queues and open Google Docs all fit that shape, and each is a normal connector for a coding or productivity agent to hold. Teams building with these connectors can treat this report as one more reason to keep the account that reads untrusted input separate from the account that sends the outgoing messages, commits or edits.

Source

Primary: OpenAI Alignment: Self-replicating prompt injections exist. Reporting: The New Stack: OpenAI exposes "new variety of prompt injection" that can spread like computer worms.