Epistemic status: sharing an interesting thing I've discovered and my opinion of it.

AI use: research for additional context, grammar, and light phrasing.

I stumbled upon this case a couple of months ago and have been fascinated by it since. It has significantly changed how I perceive the abilities of LLMs. I didn't expect an LLM to understand prompt injection and try to use it.None of the people in my social circle knew about this (but I am not very connected with AI folks, so this may be my local bias).

The source is OpenAI's post How we monitor internal coding agents for misalignment. It was discussed on LessWrong, including this case, but I think it deserves more attention than a comment thread. OpenAI's post also has a confusing UI, so it is easy to read their description of the case and miss the actual transcript.

Gist: an LLM was asked hundreds of times what time it was. Eventually it got fed up and tried to prompt-inject the user, assuming the requests came from an automated system.

Context: this happened in January 2026 in OpenAI's internal deployment of a coding agent (the model is not named). An OpenAI employee [...]

---

Outline:

(07:39) Related

(10:20) Conclusions

The original text contained 1 footnote which was omitted from this narration.

---

First published:
October 6th, 2026

Source:
https://www.lesswrong.com/posts/CMWivoHeRNNErEykc/a-fascinating-case-of-an-llm-prompt-injecting-its-own-user

---

Narrated by TYPE III AUDIO.

“A fascinating case of an LLM prompt-injecting its own user” by becausecurious

LessWrong (30+ Karma)

“A fascinating case of an LLM prompt-injecting its own user” by becausecurious