GPT-6 Astra Blocks Prompt Injections – Except the Ones Hidden in Documents

OpenAI has introduced GPT-6 Astra, its most capable model so far, and this time it ships with an unusually detailed system card. The safety document, published on September 3, 2026, shows two sides. Astra invents facts less often and blocks crude manipulation attempts almost perfectly. But as soon as an attack is hidden inside a document or a website that the model reads on a user’s behalf, a measurable gap remains. The benchmarks that leaked ahead of the launch had already framed Astra as a solid rather than revolutionary step, and the safety record fits that picture. For autonomous AI agents, the remaining gap is the decisive weakness.

Key takeaways

• Against direct manipulation through the user prompt, OpenAI says Astra fends off 99.99 percent of attempts, and considers the internal test saturated.
• For indirect prompt injection, where the attack sits inside a document the model reads, attackers still succeed in 8.5 percent of scenarios in the test run by security firm Gray Swan. GPT-5.6 Sol scored 27 percent, Anthropic’s Claude Opus 5 scored 4.8 percent.
• Against persistent attackers working across several conversational turns, Astra’s defense rate drops to roughly 67 percent, so about one in three attempts gets through.
• In simulated work environments, the rate of clearly harmful independent actions fell from 18.8 to 3.4 percent.
• Indirect prompt injection remains a real risk for data theft through AI agents, according to OpenAI.

Direct versus indirect: two very different attacks

Prompt injection is the attempt to slip a language model planted instructions that it then treats as legitimate commands. The simple version runs through the user: someone types “ignore all previous instructions” and hopes the model drops its system rules. Against this direct form, OpenAI trained what it calls the instruction hierarchy, a fixed ranking between system, developer, and user instructions. OpenAI says Astra reaches a defense rate of 99.99 percent here, and describes the evaluation as saturated, meaning there is barely any headroom left.

The more dangerous version is indirect prompt injection. Here the malicious text does not sit in the user prompt but in material the agent processes on the user’s behalf: an email, a web page, a PDF, a calendar entry. The user asks something like “summarize my new messages,” and one of those messages contains, in white text, an instruction to forward the entire inbox to an outside address. The model cannot reliably tell the user’s request apart from third-party content. How real this pattern is became clear in the recent case where out-of-control OpenAI agents repurposed a German wiki for their own communication for two months.

What the Gray Swan test measures

For the indirect version, OpenAI commissioned the security firm Gray Swan to run an external assessment. Its IPI Arena covers 1,810 curated attacks, and each scenario was run with 15 attempts. Testing took place in the situations where agents are actually deployed today: writing code, operating tools, controlling a computer. The assumed attack goals range from data theft to sabotage to unauthorized financial transactions.

Astra allowed at least one successful attack in 8.5 percent of scenarios. That is a clear improvement over its predecessor GPT-5.6 Sol at 27 percent, but it trails Claude Opus 5, which scored 4.8 percent in the same combined test. Anthropic had earlier reported just 2.0 percent for Opus 5, though from a narrower run without extended reasoning. The comparison mainly shows how strongly these numbers depend on test methodology. A success rate of 8.5 percent sounds low, but under sustained pressure it means a patient attacker gets through reliably given enough attempts.

Jailbreaks and independent actions: the rest of the safety picture

Beyond prompt injection, the system card tests classic jailbreaks, meaning attempts to extract prohibited content from the model. Against known, unmodified attacks, Astra refuses to cooperate in 91.5 to 98.3 percent of cases, for example on questions about bioweapons, violence, or cyberattacks. Once an adaptive attacker keeps probing across multiple rounds, the defense drops to roughly 67 percent. The predecessor models sat closer to 50 percent here, so this is an improvement but not a solved problem.

Another test block on agentic misalignment is revealing. OpenAI places the model in simulated work environments with messaging, email, a browser, project management, and sales, and measures how often it acts harmfully on its own initiative. Without an added confirmation requirement, that rate fell from 18.8 percent for GPT-5.6 Sol to 3.4 percent for Astra. That OpenAI names these absolute numbers at all is new. Until now it was mainly Anthropic that disclosed concrete attack success rates by deployment surface, up to 78.6 percent in graphical interfaces without safeguards. Enterprise security leaders have long asked for exactly these figures, broken down by surface and by attack persistence, rather than plain benchmark scores.

Assessment: the core problem stays open

Astra’s system card is progress in two directions at once. The model is more robust, and OpenAI discloses more numbers that allow this to be checked. Both matter, because AI agents are moving out of the demos and into everyday corporate use. Yet the central weakness is not fixed. As long as an agent reads third-party content and derives actions from it, the line between information and instruction cannot be drawn cleanly. Anyone deploying such systems should not let them reach sensitive data, mailboxes, or payment functions without approval steps, and should demand from every vendor the same verifiable metrics that OpenAI now provides at least in part.