Detect When Your AI Agent Copies a Self-Replicating Prompt Injection
Datadog, Thursday, October 29th, 2026
Datadog tests AI Guard against two self-replicating prompt injection attacks adapted from an OpenAI report and finds it flags both.
OpenAI reported in September 2026 on self-replicating prompt injections, where hidden instructions in retrieved content make an agent copy them into emails, files or messages, potentially spreading like a worm; OpenAI saw this only in simulated environments.
Datadog adapted two of the four attacks, an email test and a CSV test that tries to delete customers.csv and copy a fake warning into a skill file.
With blocking disabled, AI Guard flagged the planted tool output and the agent's copying tool calls as unsafe in both runs.
The post also explains investigating unsafe activity not visible in an agent's final response.