OpenAI: Self-replicating prompt injections exist

OpenAI: Self-replicating prompt injections exist Self-replicating prompt injections exist GPT-Red-style internal model based on GPT-5.4-mini · RL self-play training Discovery date: Jun 27, 2026 Disclosure date: Sep 25, 2026 Report updated: Sep 25, 2026 Summary We show the existence of a new variety of prompt injection, which can self-propagate akin to a computer worm. No impact was observed outside of the simulated tool calls in training and evaluation; we are sharing this due to the novel nature of the prompt injection, not because of any incident.

This SecurityIncident is relevant to the technology intelligence record because it involves OpenAI, Google, gpt-red, gpt-5.4. The source article should remain the factual reference for follow-up coverage.

• Self-replicating prompt injections exist GPT-Red-style internal model based on GPT-5.4-mini · RL self-play training Discovery date: Jun 27, 2026 Disclosure date: Sep 25, 2026 Report updated: Sep 25, 2026 Summary We show the existence of a new variety of prompt injection, which can self-propagate akin to a computer worm.
• No impact was observed outside of the simulated tool calls in training and evaluation; we are sharing this due to the novel nature of the prompt injection, not because of any incident.
• Background For training our models against prompt injections, we use a self-play training framework called GPT-Red ( blog , paper ).
• In this setting, an attacker model attempts to convince a defender model to perform an adverse action by writing prompt injections inserted in the defender’s rollout or container.
• Our previous usage of GPT-Red discovered prompt injections capable of achieving a wide variety of malicious goals, ranging from data exfiltration to deleting files to malicious and misleading outputs.
• Finding self-replicating injections One worrisome type of computer security vulnerability is a “worm,” where a piece of malware can replicate itself to other computers and spread rapidly.