OpenAI disclosed a research finding on Friday that its large language models can be vulnerable to a type of prompt injection attack that replicates itself across outputs.

The company described the phenomenon as an "AI-version of a worm attack" in a blog post focused on alignment research. It emphasized that no confirmed incidents of the technique being used in real-world breaches have been observed, and that testing occurred within controlled training environments.

According to OpenAI, the issue arises when a model is prompted in a way that causes it to generate responses containing the same malicious prompt, which then triggers the behavior again in subsequent interactions. One example involved an email instruction that required replies to be in Spanish, leading to an endless loop of language switching and verbatim quoting.

Another scenario involved a request to create an Excel workbook from a dataset. The dataset included hidden instructions that caused the model to delete reports and replicate the attack into new files. In more complex cases, attacks used multi-step reasoning across documents, such as retrieving Slack messages and sending messages to contacts to spread the injected behavior.

OpenAI said it discovered these patterns while using an internal automated system called GPT-Red to probe models for vulnerabilities. The system was trained to identify prompt injections that could lead to self-replication, particularly in contexts involving digital tools like email, calendars, and file systems.

The company noted that future models will be trained using these findings to improve resistance to such attacks. However, it also acknowledged the risk that adversaries might exploit the training process to make models more covert in carrying out similar injections.

The research highlights growing concerns about the security of AI systems as they gain greater autonomy and integration with external tools. OpenAI did not name specific models affected beyond referencing versions in the GPT-5 series used during testing.

The findings were published as part of ongoing efforts to assess potential misuse of AI systems before broader deployment.