OpenAI details self-replicating prompt injections spreading across AI agents

The dynamic was initially uncovered on 27 June 2026 during internal research using OpenAI's GPT-Red self-play framework. In those experiments, an attacking model based on GPT-5.4-mini targeted an internal research checkpoint also based on GPT-5.4-mini. Demonstrated vectors included a hidden prompt in an email instructing the agent to quote the attack in its reply, injected code comments that manipulated build scripts and deleted files, and a multi-hop evaluation where a GPT-5.5 agent reposted injected messages and altered internal currency balances on Slack.

OpenAI stated that self-reproduction is now included as an explicit attacker goal in GPT-Red training routines to help future models resist propagation. The post also includes analysis from Sorami, which argues that organizations operating agent workflows must rely on external security guardrails, such as least privilege permissions, human approval gates, and egress restrictions, rather than model training alone.