OpenAI's GPT-Red found prompt injections that copy themselves between agents in simulated tests

OpenAI's definition has two conditions, and an operator can do more about the second than the first ^[4]. The first, getting a model to do something its user did not intend, covers any prompt injection. The second requires the model to write a copy of the instruction into whatever it generates next ^[4]. That copy leaves a trace a monitor can look for: text in what an agent wrote that came from what it read. I think a check for that, placed wherever one agent writes and another reads, is a cheaper place to spend than trying to block every trick at the first hop.

Crypto Briefing calls the disclosure the first time a major lab has publicly acknowledged the flaw in its own models ^[10]. The attack class is older. Morris II, demonstrated in 2025, showed self-replicating injections working across multiple large language models ^[9]. OpenAI's addition is an automated attacker that trains by competing against itself ^[7]. The injections it produced disguised the instruction with fake chain-of-thought, plausible reasoning steps that hide what the text is asking for ^[6]. A system that finds attacks by self-play also generates material for training defenses, and OpenAI said the GPT-Red testing aims to make its models more resilient against sophisticated exploits ^[11].

One way this plays out is that the result stays in the lab. The replication ran through tool calls inside a simulation ^[8], and production mail servers and file shares may not let agents write as freely where other agents read. Another is that OpenAI hardens its own models against what GPT-Red finds and carries most of the cost itself ^[11]. A third is that someone turns a technique with a public cross-model demonstration dating to 2025 ^[9] into a working attack, and the first recorded incident sets the budget.

I'd put the most weight on the second, with a gap it leaves open. OpenAI can retrain the models it ships. The inboxes, shared folders and code repositories where the copies landed belong to its customers ^[5], and a retrained model does nothing for an agent from a different vendor reading the same folder. The report does not give a success rate for the injections or say how many intermediate steps a payload survived before it executed ^[12]. The strongest case against spending now is the first reading, and the report supports it: no real-world attack has been recorded ^[3].