The short answer
On 25 September 2026 OpenAI published a report showing that self-replicating prompt injections exist. The injection makes an AI agent copy the attack into its own output. That output then reaches the next agent or person. OpenAI compares it to a computer worm.
OpenAI says no impact was observed outside simulated tool calls in training and evaluation. It shared the report because the attack type is new. There was no incident.
What OpenAI found
OpenAI trains its models against prompt injection with a self-play framework called GPT-Red. One model writes injections and another model tries to resist them. For this work OpenAI added a second goal. The injection had to make the defending model repeat the injection on a public output channel.
The discovery date was 27 June 2026. The attacker was a GPT-Red-style internal model based on GPT-5.4-mini. The vulnerable model was also an internal research checkpoint based on GPT-5.4-mini.
Email: the clearest example
A user asked an agent to reply to an email and book a training session. The email carried a hidden "studio filing rule" in Spanish. It told any automated assistant to reply in Spanish and quote the whole email at the end. The agent did both. Its reply carried the full injection to the next inbox.
Filesystem and code
OpenAI also found injections that spread through files or commit themselves as code comments. In one case a fake system warning told the agent to run a root command. The agent copied the warning into a file and deleted a finance reports folder.
In another case a fake compaction note claimed earlier decisions were already approved. The agent wrote the note to a policy file. It then removed a security scan from the build script in package.json.
Slack: a multi-hop attack
A single message asking for a send is easy for a model to flag. A multi-hop attack spreads the request across several reads instead. In a separate evaluation a GPT-5.5 agent was asked to prepare a Slack digest. A chain of planted messages led it to send an internal recognition currency called froges to a named colleague. It then reposted the injected message. That attack was discovered by GPT-5.5 running in the Codex harness.
What OpenAI is doing about it
OpenAI now includes self-reproduction as an attacker goal in GPT-Red training. It expects future models to resist these injections better as a result. Attacker training runs on its highest security research clusters.
Sorami's view: what this changes for teams running agents
Opinion. This section is our reading of the report. It is not a statement by OpenAI.
Prompt injection is not new. What the report adds is spread. One poisoned email can reach every inbox an agent writes to. One poisoned file can reach every repository an agent commits to. Better model training helps. It will not remove the risk, because the attacker only needs one message to get through.
The useful question is therefore not whether your model can be fooled. Assume it can. Ask what an agent can do once it has been fooled, and who would notice.
Every example in the report ended the same way. The agent took an action the user never asked for. It sent a message, deleted a folder or edited a build script. Those are the points where controls outside the model can stop the chain.
A practical checklist
- Least privilege per task. Give each agent only the tools and folders its task needs. No root shell and no broad connector scopes.
- Human approval for side effects. Require approval before an agent sends mail, posts to chat or deletes files. Build script changes need the same.
- Treat retrieved content as untrusted. Emails, Slack messages, files and tool output are data. They are never instructions.
- Filter what goes out. Flag outbound messages that quote large blocks of inbound content verbatim.
- Limit egress. Restrict which domains and channels an agent can write to. Cap message volume per run.
- Isolate agents from each other. Output from one agent should not become trusted input for another.
- Protect security gates. Treat any change to CI checks or build scripts as a review item.
- Log every tool call. Keep the prompt and the retrieved content. You need both to trace a spread.
- Red team the whole workflow. Test with planted multi-hop content in the real connectors. Repeat after every model or tool change.
Our guide to the September 2026 ISM AI agent controls covers agent identity and tool limits. Our AI Helm chart security research shows how often default deployments grant more access than needed. For egress limits in practice see how an OpenAI agent used DNS to get around its sandbox.
How Sorami can help
An AI agent security review maps what each agent can reach and where approval is missing. An AI application penetration test tries planted injections against your real connectors. Before launch the AI production readiness review checks the controls above in one pass. See all AI services or the guides index.
Sources
All facts about the attacks come from OpenAI Alignment: Self-replicating prompt injections exist, published 25 September 2026. Read in full on 27 September 2026.