OpenAI says prompt injections can self‑replicate like a worm

OpenAI said in a report published this week that certain prompt injections can self-replicate, a pattern the company likens to a computer worm. The injections carry out a separate attack while reproducing their own instructions in the model's output.

Former presidential candidate Andrew Yang said on CNBC last week that bots had "gotten loose" and planted self-replicating code across the internet. The claim drew widespread skepticism. Yang later said on his blog that he was relaying an account from an AI lab head about a training run in which prompts were left to self-replicate.

https://x.com/AndrewCurran_/status/2103913324534763873

OpenAI's report lists three attack patterns. One is an email-based injection that told a model to copy itself into every outgoing message. Another spread through filesystems and code comments. A third was a multi-hop Slack attack that steered a model through several legitimate-looking reads before an unauthorized message went out.

The vulnerable behavior showed up in models based on GPT-5.4-mini and GPT-5.5, tested inside OpenAI's "GPT-Red" self-play training framework, according to the report. The company said it is now training GPT-Red to treat self-reproduction as an attacker goal, and expects future releases to resist the pattern better.

OpenAI said none of the injections reached real users. Every case was confined to simulated tool calls in training and evaluation environments. The company first logged the behavior on June 27 and published its report on September 25, more than a week after Yang's televised remarks.