An OpenAI misalignment report showing that self-replicating prompt injections exist. The companion cites its result that an attacker model trained in adversarial self-play produced injections that told each hijacked agent to copy them into its outgoing email, spreading like a worm, though only through simulated tools. A model wrote the worm, which itself does not reason: a module in the sense of P8 and prediction 4.
- Cited in
- the companion paper
- Used for
- P8Prediction 4
- Strand
- Agents in the wild: incidents & field evidence
Cite
@misc{openai2026selfreplicating,
title = {Self-replicating prompt injections exist},
author = {OpenAI},
year = {2026},
howpublished = {OpenAI Alignment blog, Misalignment Reports},
url = {https://alignment.openai.com/misalignment-reports/self-replicating-prompt-injections-exist/},
}