OpenAI confirms existence of self-replicating prompt injections

OpenAI has officially confirmed what security researchers have feared for years: prompt injections can replicate themselves and spread between AI agents like a digital worm. The company disclosed on September 25, 2026, that its internal research team discovered the capability in a training environment, marking the first time a major AI lab has publicly acknowledged self-replicating prompt injection vulnerabilities in its own models. The discovery was initially made on June 27, 2026, roughly three months before the public disclosure. No real-world attacks have been recorded. How an AI worm actually works For a prompt injection to qualify as “self-replicating” under OpenAI’s framework, it needs to do two things. First, it must achieve an adversarial goal, meaning it tricks the AI into doing something the user didn’t intend. Second, it must reproduce itself across the model’s output channels, embedding a copy of the malicious instruction in whatever the AI generates next. The research identified several replication vectors. Email was one: an injected prompt could instruct an AI agent to embed the injection in its outgoing messages, infecting whatever AI agent processes those messages ...