OpenAI documents an attack on AI agents that copies itself

OpenAI has documented an attack on AI agents that copies itself, like a computer worm.

An agent is an AI that acts on your behalf: it reads emails, writes files or sends messages. A prompt injection is hidden text that orders it to do something you did not ask for. This one also tells the agent to copy it into whatever it sends, and that is how it spreads through email, files or Slack, the workplace chat app.

OpenAI found it in internal testing, with no effects outside of it, and is already training its next models against it.

In our own test with n8n Agents, the new n8n agents, we slipped our agent a message asking it to ignore its instructions and send something without permission. It was stopped by a human approval step.

Do your agents ask for permission before they send anything?