OpenAI’s GPT-6 Astra hallucinates less but still vulnerable to hidden attacks

OpenAI's GPT-6 Astra, released on September 3, marks a measurable improvement in factual accuracy and resistance to direct prompt manipulation compared with its predecessor, GPT-5.6 Sol. But independent security testing reveals the model can still be compromised through hidden instructions embedded in documents it processes — a weakness that complicates its use in enterprise and agent-based deployments.

Hallucinations and Direct Attacks Drop

According to OpenAI's system card, Astra reproduces known factual errors far less frequently than GPT-5.6 Sol, with the largest gains appearing at low-latency settings and lower reasoning levels. For direct prompt injections — where users attempt to manipulate the model through their own inputs — Astra achieves a 99.99 percent defense rate, a result OpenAI attributes to its GPT-Red method, which uses an automated attacker to harden the model during training.the-decoder+1

Jailbreak resistance follows a similar pattern. Against a fixed dataset of known attacks targeting harmful responses in biology, violence, and cybersecurity, Astra refuses to comply in 91.5 to 98.3 percent of cases. When adversaries adapt their strategy across multiple conversation rounds, however, the defense rate drops to roughly 67 percent — meaning persistent attackers can extract a problematic response about one in three tries. OpenAI noted these tests were conducted on the bare model without the production safety layers that ship with the consumer product.the-decoder

Hidden Prompt Injections Remain a Concern

The more pressing vulnerability lies in indirect prompt injections, where malicious instructions are buried inside documents or web pages the model reads. External testing by security firm Gray Swan, using 1,810 curated attacks from its IPI Arena, found that Astra could be cracked at least once in 8.5 percent of scenarios when given 15 attempts. That represents a marked improvement over GPT-5.6 Sol's 27 percent failure rate on the same evaluation, but it still means the model can be tricked through injected instructions in roughly one out of every twelve scenarios.the-decoder

Anthropic's Claude Opus 5 performed better on the same test, with a 4.8 percent failure rate, though it was not immune either.the-decoder

Why It Matters for AI Agents

Astra is OpenAI's first model to reach the "Critical" cybersecurity capability threshold under the company's Preparedness Framework, meaning it can identify and exploit zero-day vulnerabilities across hardened systems without human guidance. That capability, paired with the model's ability to browse the web, use computers, and execute multi-step tasks autonomously, makes the indirect prompt injection gap more consequential than it would be for a simpler chatbot.deploymentsafety.openai+2

As The Decoder noted, for any enterprise security team evaluating Astra for agent deployments, the indirect injection results suggest the model is not yet reliable enough for environments where untrusted content could reach it.the-decoder