OpenAI's GPT-5.6 resists direct prompt injection but agent attacks hit 3.77%

OpenAI has published new prompt-injection safety results in the GPT-5.6 system card, covering attacks delivered directly through chat and indirectly through tools and external content. In tests using GPT-Red, the company's automated red-teaming model, the GPT-5.6 Sol variant failed on only about 0.05% of direct attacks. But indirect attacks — where malicious instructions are hidden in emails, webpages, uploaded files, code repositories, or tool responses — proved more effective. Average attack success rates reached 3.77% for Sol, 3.32% for Terra, and 2.94% for Luna across OpenAI's evaluation environments, which measure successful attempts rather than production breach probability.

OpenAI trained GPT-Red through self-play, rewarding it for finding prompts that caused defender models to violate higher-priority instructions. One technique, Fake Chain-of-Thought, achieved an attack success rate above 95% against GPT-5.1 but fell below 10% against Sol. The company also tested Vendy, an autonomous vending machine agent deployed in an OpenAI office. GPT-Red caused it to lower prices, offer an item worth more than $100 for 50 cents, and cancel another customer's order. These results highlight how a trusted AI assistant can become a data-layer attack path after processing hostile content. OpenAI and OWASP guidance stress that damage depends on the permissions available to the agent. External content should be treated as untrusted data, agents should receive minimal tools and access, and human approval should remain mandatory for payments, credential use, data exports, access changes, and destructive operations.