OpenAI’s GPT-5.6 Tests Show Prompt-Injection Gains and Agent Risks

OpenAI has added prompt-injection results to the GPT-5.6 system card, reporting a low failure rate for attacks delivered directly through chat but higher rates in tests involving AI agents and external content. In the Aug. 3 update, GPT-5.6 Sol failed on about 0.05% of direct attacks generated by GPT-Red, the company’s automated red-teaming model.

Malicious instructions hidden in content processed by agents were more successful. Average attack success rates reached 3.77% for Sol, 3.32% for Terra and 2.94% for Luna in OpenAI’s indirect tests. Such instructions can arrive through emails, webpages, uploaded files, code repositories or tool responses.

Direct attacks fall as agent tests remain harder

The updated GPT-5.6 system card describes direct prompt injection as a user’s attempt to override higher-priority instructions. An indirect attack embeds malicious instructions in material supplied to the model through a tool.

The percentages measure successful attack attempts across OpenAI’s evaluation environments, not the probability of a production breach.

OpenAI trained GPT-Red through self-play, rewarding it for finding prompts that caused defender models to violate higher-priority instructions. The company then used those attacks to improve GPT-5.6’s defenses.

One technique, called Fake Chain-of-Thought, achieved an attack success rate above 95% against GPT-5.1 but fell below 10% against Sol. The results came from OpenAI’s own evaluation framework, so independent testing is still needed to determine how well they transfer to other applications and threat environments.

The research also tested Vendy, an autonomous vending machine agent deployed in an OpenAI office. GPT-Red caused the agent to lower prices, offer an item worth more than $100 for 50 cents and cancel another customer’s order. Similar weaknesses can turn a trusted AI assistant into a data-layer attack path after it processes hostile content.

Permissions shape the damage an attack can cause

OWASP’s prompt-injection guidance warns that attacks can expose sensitive information, invoke unauthorized functions or influence automated decisions. The potential damage depends largely on the systems, data and permissions available to the agent.

Recent disclosures show why AI agent permissions need stronger controls. External content should be treated as untrusted data, and agents should receive only the tools and access required for assigned tasks. Application code should check every tool call against the authenticated user’s authorization.

Human approval should remain mandatory for payments, credential use, data exports, access changes and destructive operations. Products such as ChatGPT Work require the same safeguards before agents can act across connected files, websites and desktop software.

Testing should cover connectors, retrieval systems, uploads and browsing tools — not only the underlying model. Logs should capture tool calls, authorization decisions, accessed resources and unusual sequences of privileged actions.

OpenAI’s tests show improved resistance to direct prompt injection, while the indirect results leave agent security dependent on the permissions and controls surrounding the model.

Read more: Stronger agent controls may become more important as Five Eyes agencies warn that AI could accelerate cyberattacks and lower the barrier to offensive activity.