OpenAI trained attacker models to write prompt injections against defender models in a test environment. Some injections made the defender do something unwanted and also copy the injection into its own outputs, such as emails, files or code comments, so it could spread to the next system that read them. OpenAI observed no effect outside the simulated tools.
Why it matters. Demonstrates the mechanism behind an AI 'worm' in a controlled setting, before one has been seen in the wild.
Primary research disclosure with synthetic examples and model-attribution details.
Backed by developer or operator account. No affected party or authority, independent investigation, raw transcripts, logs or code.
Basis for this claim
The report explicitly says no impact was observed outside simulated tool calls.
Self-replicating prompt injections exist Developer · Controlled examples, model roles, discovery/disclosure, containment, and mitigation.Where: Summary; More complex attacks; Responsible models and impact; How we are addressing it
What this does not establish
First-party account; underlying environment was not independently examined.
Consequences & response
Effects
A controlled propagation mechanism was demonstrated.
No independently observed public outbreak or outside victim.
Response & proposed fixes
OpenAI reports including self-reproduction in adversarial training goals.
Editorial recommendation: make outbound writes follow original task authority rather than retrieved instructions.
Controlled examples, model roles, discovery/disclosure, containment, and mitigation.
Where: Summary; More complex attacks; Responsible models and impact; How we are addressing it
Cite & correct
misaligned.fyi. “Researchers demonstrate self-replicating prompt injections.” Case MF-037, record updated 17 Oct 2026. https://misaligned.fyi/cases/self-replicating-prompt-injection