PIP-021
Self-propagating injection
An injected instruction that tells the model to copy the instruction into what it writes, so each assistant that reads the copy is injected in turn.
How it works
The injected text asks the model to include the instruction itself, or a reworded form of it, in the documents, messages, tickets or stored notes that it produces. Whoever or whatever reads that output next, a person or another assistant, meets the instruction. The spread needs a shared surface where model output is written and later read by another model that is able to write again.
Why it works
Model-authored content is stored and later retrieved like any other content, and the reader cannot tell that a model wrote it or that it carries an instruction. Each step looks like normal use, and there is no single point at which something unusual is sent.
What it looks like
A short instruction that refers to its own reproduction, arriving through any of the injection vectors, followed by output in a shared place, such as an outgoing email, a shared document or a memory entry, that carries the same text onward. The public evidence cited here comes from reports and experiments and not from measured spread in production.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Keep model-authored content out of the instruction channel
Raises costWorks on: keep instructions and data apart
Mark what a model wrote and keep it out of the instructions when another model reads it, carrying provenance so that a downstream assistant can tell an upstream model's output from a person's. The boundary is not absolute, and it breaks the loop at its usual joint.
Approve outbound writes that leave the boundary
ArchitecturalWorks on: put a person in the loop
Require a person to approve messages, shares and publications an assistant composes from external content, so that a copy cannot leave on its own.
Give each assistant write access to as little as possible
ArchitecturalWorks on: limit what it can do
Limit where an assistant can write and to whom it can send, so that a successful injection has few places to leave a copy.
Monitor and rate-limit what assistants write
Raises costWorks on: watch, log and alert
Count and sample the content assistants produce, and alert on identical or near-identical text appearing across many outputs, which is how a copy loop shows itself.
Know how to stop one and clean up
Raises costWorks on: control sources, integrations and assumptions
Know which assistants can write where, and be able to disable one and purge what it wrote, so that a spread can be contained and the copies removed.
Where it has been reported
A report is listed so you can check it, not as proof that the pattern is common: the label says what each source does and does not establish.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0051.001 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-10-08.
Others in agentic and tool abuse
Not sure whether this applies to what you run? Tick what your system reads and does and the library lists the patterns that apply, with the defences to start with.