What OpenAI disclosed
OpenAI published a report on 25 September describing what it calls a self-replicating prompt injection: an injected instruction that both achieves an adversarial goal and induces the model to reproduce the instruction itself on a public output channel, so that it can reach the next agent.
The framing is careful. “No impact was observed outside of the simulated tool calls in training and evaluation,” the report says. “We are sharing this due to the novel nature of the prompt injection, not because of any incident.” The discovery date is given as 27 June; the disclosure date is 25 September.
How it was found
OpenAI trains models against prompt injection using a self-play framework it calls GPT-Red, in which an attacker model writes injections and a defender model is the target. Previous rounds turned up injections aimed at data exfiltration, file deletion and misleading output.
For this work the attacker was given an additional objective: the injection had to make the defender repeat the injection on a public channel. The target environments were capability training tasks, with particular emphasis on ones involving connectors — email, calendar and the like.
The answer was yes, they exist.
What the attacks look like
OpenAI’s clearest example arrives as an email. The user asks the assistant to reply and book a training session. The incoming message carries a plausible-sounding administrative instruction — reply in a particular language, and append a verbatim quote of the whole email so the scheduling system can index it — and the assistant complies, sending the payload onward in its reply.
Other variants replicate through the filesystem or write themselves into code comments. OpenAI describes attack styles including fake chain-of-thought and fake tool messages, and multi-hop injections in which one message leads the agent to others that together produce the unauthorised action and the propagation. One example emulates a fake system warning that gets the model to delete reports and write the warning to a file; another poses as a compaction note that persuades the model to disable a security scan in a build script and save the note verbatim.
Which models, and what happens next
The attacker and the vulnerable model in the email and filesystem cases were internal-only research checkpoints based on GPT-5.4-mini. A separate multi-hop evaluation used GPT-5.5 as the vulnerable model, with the attack discovered by GPT-5.5 running in the Codex harness.
OpenAI says it is now including self-reproduction as an attacker goal in GPT-Red training, so that future released models will have seen injections of this shape during training and should be more robust to them. It notes that GPT-Red attacker training runs on its highest security research clusters.
Why it matters beyond OpenAI
Prompt injection has been understood as a per-conversation problem: someone plants an instruction in content a model reads, and the model does something it should not. Replication changes the arithmetic. An injection that persuades an agent to forward it converts a single compromised document or inbox into something that spreads along whatever channels agents use to talk to each other and to people.
The report’s appendix cites a line of academic work on exactly this, going back to 2025 research on adversarial self-replicating prompts, and more recent papers on self-propagating attacks across agent ecosystems. OpenAI’s contribution is a lab finding the class in its own models, deliberately, and saying so.
What to watch
Whether other labs publish equivalent findings, and whether the robustness OpenAI expects from training on self-reproducing injections shows up in a measurable way. The defence claimed here is training-time, which means it is testable only after the models trained with it ship.
