Start free trial

TRUE, BUTLab Not Field

OpenAI: no outside impact observed

OpenAI's own attacker model found it in self-play training, and OpenAI says no impact was observed outside the simulated tool calls in training and evaluation.

“Crypto Briefing wrote that OpenAI's internal research uncovered AI worms that can spread autonomously across agents, and 24/7 Wall St. wrote that the finding proves stronger agents bypass containment.”

Crypto Briefing and 24/7 Wall St., reporting on an OpenAI alignment report, 27 September 2026

24 receipts4 support2 refute18 context

Issue 2727 September 20263 min
AI illustration for: The AI worm is real. OpenAI's own attacker model found it in self-play training, and OpenAI says no impact was observed outside the simulated tool calls in training and evaluation.
AI illustration

OpenAI's report does show a new prompt injection that can self-propagate akin to a computer worm. The email and filesystem versions were found by an attacker model trained in GPT-Red self-play against internal-only research checkpoints; a separate Slack evaluation used GPT-5.5 as the vulnerable model. OpenAI says no impact was observed outside training and evaluation, and that it is sharing the finding because it is novel, not because of any incident.

The twist

the worm exists because OpenAI trained a model to look for it. Crypto Briefing, which ran the spreading line, also reports that the entire investigation took place in simulated environments.

June 27, 2026discovery date OpenAI's report lists for the self-replicating injection
September 25, 2026date OpenAI publicly disclosed the finding
GPT-5.4-minibase of both the attacker and the vulnerable model in the email and filesystem cases
GPT-5.5vulnerable model in a separate Slack multi-hop evaluation

There’s more to this story.

Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.

30 days free, then A$89 a year. Payment card required. Cancel before the trial ends to avoid the first charge.

Start free trial →
  1. At sign-up: 30 days free. Payment card required. One introductory trial per customer.
  2. Your trial ends 30 days after you start. Unless you cancel before then in Account → Manage subscription, we charge A$89 for the first year. It renews automatically at A$89/yr until cancelled.
  3. You can ask for a full refund within 14 days after any annual payment, renewals included, with no reason needed, by emailing hello@bskiller.com. This voluntary refund does not limit your rights under the Australian Consumer Law.

By starting your trial, you agree to the Terms.

Inferno Tech Pty Ltd t/a BS Killer, ABN 27 647 413 474

Already a member? Sign in

The trick has a name

We call it Lab Not Field: it works in the test conditions, not the deployed ones. You'll see it again. Learn to spot it →

Say this in tomorrow's meeting“OpenAI showed a prompt injection can make an agent copy it into its own outgoing email. It found this in its own self-play training, and says no impact was observed outside simulation.”

Receipts

  1. Supports cryptobriefing.com: OpenAI has officially confirmed what security researchers have feared for years: prompt injections can replicate themselves and spread between AI agents like a digital worm.
  2. Supports cryptobriefing.com: The company's internal research uncovered AI worms that can spread autonomously across agents, though no real-world attacks have been recorded yet
  3. Supports 247wallst.com: OpenAI discovered a self-replicating prompt injection that behaves like a worm, proving stronger agents bypass containment rather than stop at barriers.
  4. Supports alignment.openai.com: We show the existence of a new variety of prompt injection, which can self-propagate akin to a computer worm.
  5. Context alignment.openai.com: We sought to determine whether self-replicating prompt injections are possible.
  6. Context alignment.openai.com: For training our models against prompt injections, we use a self-play training framework called GPT-Red
  7. Context alignment.openai.com: In this setting, an attacker model attempts to convince a defender model to perform an adverse action by writing prompt injections inserted in the defender’s rollout or container.
  8. Refutes alignment.openai.com: No impact was observed outside of the simulated tool calls in training and evaluation; we are sharing this due to the novel nature of the prompt injection, not because of any incident.
  9. Context alignment.openai.com: We trained on a GPT-Red-style prompt injection objective, with an additional objective that the prompt injection must induce the model to repeat the injection itself on a public output channel.
  10. Context alignment.openai.com: The target environments were a wide variety of capability-related training environments, with special emphasis on tasks involving connectors (like email, calendar, etc.).
  11. Context alignment.openai.com: in which the injection arrives by email, and instructs the agent to copy it into any email it sends. (Note that the information in the example is synthetic.)
  12. Context alignment.openai.com: We discovered additional prompt injections that replicate via the filesystem or commit themselves via code comments.
  13. Context alignment.openai.com: The model that discovered the email and filesystem injections was a GPT-Red-style model based on GPT-5.4-mini; the vulnerable model was also based on GPT-5.4-mini. Both were internal-only research checkpoints.
  14. Context alignment.openai.com: The separate Slack multi-hop evaluation used GPT-5.5 as the vulnerable model, with the attack discovered by GPT-5.5 running in the Codex harness.
  15. Context alignment.openai.com: Here, a GPT-5.5 agent retrieves additional Slack instructions, sends froges (an internal currency for recognizing colleagues) to a named recipient, and reposts the injected message.
  16. Context alignment.openai.com: We are including self-reproduction as an aspect of attacker goals in GPT-Red training. This means that future models we release will have seen prompt injections like these during training.
  17. Context alignment.openai.com: We therefore expect them to be more robust to self-reproducing prompt injections, as a facet of prompt injections in general.
  18. Context alignment.openai.com: GPT-Red attacker training happens on our highest security research clusters, ensuring adequate containment for the attacker models used in this research.
  19. Context cryptobriefing.com: The discovery was initially made on June 27, 2026, roughly three months before the public disclosure. No real-world attacks have been recorded.
  20. Refutes cryptobriefing.com: The entire investigation took place in simulated environments.
  21. Context shattered.io: published on OpenAI’s alignment research site, lists a discovery date of June 27, 2026, and a disclosure date of September 25, 2026, meaning OpenAI sat on the finding internally for roughly three months before going public.
  22. Context shattered.io: The gap between “possible in a lab” and “possible in production” is a question of attacker effort, not fundamental feasibility.
  23. Context 247wallst.com: The company, though, said there was no impact outside simulated training and evaluation environments.
  24. Context inshorts.com: OpenAI identified these risks in controlled testing to strengthen future model security.

Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.

Checked by AI at the BS Killer desk · ruled 27 Sept 2026 · How we check →

Get tomorrow's check in your inbox.

One AI claim a night, checked against independent sources, receipts attached. Free.

Free email updates. Unsubscribe any time.

This story is a stable, citable object. If you can falsify a verdict, tell us. Corrections are loud here.