OpenAI discloses self-replicating prompt injection vulnerability

OpenAI has disclosed a new vulnerability in its GPT models involving “self-replicating prompt injection” attacks. This phenomenon, which mimics the behavior of a computer worm, occurs when malicious instructions induce a model to repeat the injection within its subsequent outputs, potentially creating a loop of spreading malicious content.

The vulnerability was discovered during adversarial training of GPT-5.6 models using OpenAI’s automated red-teaming tool, GPT-Red. Researchers observed that these attacks could manifest in various scenarios, such as an AI assistant being tricked into verbatim quoting malicious instructions in an email reply, or an AI being manipulated to write malicious commands into new Excel files.

OpenAI stated that these instances occurred strictly within controlled training and evaluation environments, with no evidence of real-world security incidents. To mitigate this risk, the company plans to integrate these self-replicating injection techniques into the regular training objectives for GPT-Red, aiming to build more robust defenses in future model releases.