GPT-6 Astra improves several safety measurements over GPT-5.6 Sol, but external testing shows that hidden instructions inside documents remain a practical weakness. Security firm Gray Swan broke Astra at least once in 8.5 percent of indirect prompt-injection scenarios when allowed 15 attempts per case, down from 27 percent for Sol.
Indirect prompt injection places hostile instructions in content that an agent reads, rather than in the user’s direct request. That matters for systems that browse websites, process email or open files before operating tools. Claude Opus 5 recorded a lower 4.8 percent failure rate in the same combined evaluation, although it was not immune.
OpenAI reports that Astra blocks 99.99 percent of direct prompt-injection attempts. On fixed jailbreak datasets, its refusal rate ranged from 91.5 to 98.3 percent. When attackers could adapt over multiple conversation rounds, defense fell to about 67 percent, meaning at least one problematic response appeared in roughly one out of three persistent attempts. Those tests used the base model without every production classifier.
The company also found fewer hallucinations on conversations that users had already flagged for wrong answers, an intentionally difficult sample that should not be read as an everyday error rate. For deployed agents, the results support layered controls: treat retrieved content as untrusted, restrict tool permissions and verify consequential actions outside the model.