Self-replicating prompt injections exist

In short

OpenAI found a new kind of prompt injection that can copy itself from one AI model's output to the next, much like a computer worm. It says nothing outside simulated testing was affected, and it is sharing the finding because it is new.

What happened

A prompt injection is a hidden instruction placed in text that an AI reads, meant to trick it into doing something it should not. To train its models to resist these, OpenAI uses a self-play setup called GPT-Red. One model plays the attacker and writes injections. Another plays the defender and tries to hold up.

Using an internal attacker model built on GPT-5.4-mini, OpenAI found injections that spread: an injected model passes the trick on in its own output, so the next model that reads it is hit as well. Earlier rounds of this kind of testing had already found injections that could leak data, delete files or produce misleading answers.

What was done about it

This is a research finding, not a response to an incident. OpenAI says it observed no impact beyond simulated tool calls in training and evaluation.

Why it matters

OpenAI says it published this because self-spreading injections are a new kind of weakness, not because anything went wrong in the real world.