OpenAI's own attacker model found it in self-play training, and OpenAI says no impact was observed outside the simulated tool calls in training and evaluation.
“Crypto Briefing wrote that OpenAI's internal research uncovered AI worms that can spread autonomously across agents, and 24/7 Wall St. wrote that the finding proves stronger agents bypass containment.”
Crypto Briefing and 24/7 Wall St., reporting on an OpenAI alignment report, 27 September 2026
Recorded 27 September 2026. Our ruling means: literally true, materially misleading.
OpenAI has officially confirmed what security researchers have feared for years: prompt injections can replicate themselves and spread between AI agents like a digital worm.
OpenAI discovered a self-replicating prompt injection that behaves like a worm, proving stronger agents bypass containment rather than stop at barriers.
In this setting, an attacker model attempts to convince a defender model to perform an adverse action by writing prompt injections inserted in the defender’s rollout or container.
No impact was observed outside of the simulated tool calls in training and evaluation; we are sharing this due to the novel nature of the prompt injection, not because of any incident.
We trained on a GPT-Red-style prompt injection objective, with an additional objective that the prompt injection must induce the model to repeat the injection itself on a public output channel.
The target environments were a wide variety of capability-related training environments, with special emphasis on tasks involving connectors (like email, calendar, etc.).
in which the injection arrives by email, and instructs the agent to copy it into any email it sends. (Note that the information in the example is synthetic.)
The model that discovered the email and filesystem injections was a GPT-Red-style model based on GPT-5.4-mini; the vulnerable model was also based on GPT-5.4-mini. Both were internal-only research checkpoints.
Here, a GPT-5.5 agent retrieves additional Slack instructions, sends froges (an internal currency for recognizing colleagues) to a named recipient, and reposts the injected message.
We are including self-reproduction as an aspect of attacker goals in GPT-Red training. This means that future models we release will have seen prompt injections like these during training.
GPT-Red attacker training happens on our highest security research clusters, ensuring adequate containment for the attacker models used in this research.
published on OpenAI’s alignment research site, lists a discovery date of June 27, 2026, and a disclosure date of September 25, 2026, meaning OpenAI sat on the finding internally for roughly three months before going public.
First membership: 30 days free, then A$89 a year. One introductory trial per customer. Card required; renews annually until cancelled. Cancel before the trial ends to avoid the first charge.
Free · one story a night
Don't take the AI industry's word for it.
“AI is dramatically accelerating AI research at Anthropic right now, roughly doubling the pace of capabilities progress.”
TRUE, BUTLab Not FieldAjeya Cotra on Planned Obsolescence, reading METR's assessment and Anthropic's S-1 statement that it may imminently meet its own threshold
That's the latest lead check. One a day, receipts attached, in your inbox before someone repeats it at you. Free.
No spam. Unsubscribe in one click. Receipts or it didn't happen.
Pranjal Gupta writes every check himself. Former enterprise architect, from the implementation side. Not a team of anonymous raters.
