Incident·WS-0109·Jun 27, 2026·in the lab·AI security flaws
Self-spreading prompt-injection 'worm' jumps between agents
28/100
WS-2 ModerateHarm score 0, signal score 62. Autonomy: acted (the AI took a bounded action). How the scores work.
Harm 0/5
damage actually done
Reach 0/5
who was affected
Autonomy 2/4
how much the AI did on its own
Novelty 4/5
how new the behavior was
Permanence 0/5
how hard it is to undo
OpenAI showed that attack prompts can be crafted to make victim agents both obey and re-publish them, spreading agent-to-agent through email, files, code comments and chat — so far only in simulation.
Damage
None (simulation)
Sources
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
