OpenAI finds self-propagating prompt injection in simulated evaluations, with no observed impact outside the tests
OpenAI published research on a type of prompt injection that can induce agents to repeatedly relay malicious content. The source explicitly states that observations occurred only in simulated tool calls during training and evaluation, not in an external computer worm outbreak.
Source Facts
On 25 September, OpenAI disclosed self-propagating prompt injection found during research. Testing examined not only whether an agent could be misled but also whether its outputs carried the same untrusted content into other tools or documents.
The report's tool calls and example data were all part of simulated evaluations, with no effects observed outside that scope. The findings remind developers that when external text is treated as work instructions, risk can propagate through email, files or other outputs.
Defences should check both what an agent reads and what it intends to send elsewhere.
Original sources
Self-replicating prompt injections exist
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
IllustrationSOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process
Illustration