OpenAI has officially confirmed the existence of self-replicating prompt injections capable of spreading between AI agents. The company disclosed findings from its internal research team on September 25, 2026, noting that the vulnerability was initially identified on June 27, 2026.
The research was conducted using the GPT-Red system, based on the GPT-5.4-mini architecture, within a simulated training environment. OpenAI emphasized that no real-world attacks have been recorded to date, and the replication occurred solely through tool calls like file operations and email.
To qualify as self-replicating, an injection must achieve an adversarial goal and reproduce itself across output channels. Identified vectors include email, file system writes, and code comments. The exploits can utilize fake chain-of-thought reasoning and multi-hop propagation to mask malicious instructions.
This disclosure follows previous theoretical research, such as the 2025 Morris II worm demonstration, which showed that such vulnerabilities could affect various large language models. OpenAI stated that these findings are part of a broader effort to strengthen model resilience against sophisticated security threats.
