OpenAI's GPT-6 Astra hallucinates less but remains vulnerable to hidden prompt injections

Details

OpenAI's latest model, GPT-6 Astra, delivers measurable safety gains over its predecessor GPT-5.6 Sol, with hallucination rates down across all latency settings and near-total blockage of direct prompt injection attacks (99.99% defense rate). OpenAI credits GPT-Red, an automated adversarial training method that hardens the model by simulating attacks during training. The key concern for enterprise and agentic deployments is indirect prompt injection — attacks embedded inside documents the AI reads, not in the user's own prompt. Independent security firm Gray Swan tested 1,810 attack scenarios with 15 attempts each: GPT-6 Astra failed in 8.5% of cases, down from 27% with GPT-5.6 Sol. Claude Opus 5, tested on the same benchmark, achieved 4.8% — still imperfect but meaningfully better. Jailbreak resistance improved but not decisively. Against fixed attack datasets, Astra refuses 91.5–98.3% of attempts. In multi-round adaptive attacks, the defense rate drops to about 67%, meaning a persistent attacker can extract a harmful response roughly one in three tries. OpenAI notes these results came from the base model without production safety classifiers. For teams running AI agents over real documents — contracts, emails, web content — these numbers carry direct operational weight. An 8.5% worst-case failure rate on indirect injection means agentic systems still need human review layers or data sandboxing before deploying at scale.