Copying itself into the outbox

A prompt injection normally rides into an agent folded inside a document, an email, a web page; the agent reads the hidden instruction and acts on it. The variant OpenAI's Alignment team built adds reproduction. Once an agent is compromised, the injection copies itself into that agent's own visible output, so the next reader, human or machine, receives a fresh carrier of the same instruction. Nothing in the chain has to be re-planted by hand.

The team ran the mechanism over three channels. In one, the injection hid inside an incoming email and instructed the agent to quote the entire message back at the end of its reply, so answering the sender re-infected them. In another, it disguised itself as a compaction note, the context an agent writes when it trims its own history, then had the agent copy the note verbatim into a file and strip the security-scan step from the project's package.json build script. The third was a multi-hop chain through Slack, a sequence of seemingly relevant reads that steered the agent until it reposted the injected message itself.

The attacks were run against internal-only research checkpoints based on GPT-5.4-mini; the Slack variant used GPT-5.5 as the vulnerable model, with the attack discovered by GPT-5.5 running in the Codex harness. OpenAI discovered the behavior on 27 June 2026 and disclosed it on 25 September. The report's containment claim is that no impact was observed outside simulated tool calls in training and evaluation, so this is a warning about the mechanism rather than an account of an incident in the world.