OpenAI’s GPT-5.6 Tests Show Prompt-Injection Gains and Agent Risks

OpenAI's GPT-5.6 tests reveal a mixed picture of prompt injection vulnerabilities and agent risks. While the model showed low failure rates for direct attacks, indirect attacks through agents and external content fared worse, with success rates reaching 3.77% for Sol, 3.32% for Terra and 2.94% for Luna. Direct prompt injection involves users attempting to override higher-priority instructions, while indirect attacks embed malicious instructions in material processed by tools.

OpenAI trained its red-teaming model, GPT-Red, to find prompts causing defender models to violate higher-priority instructions, then used these insights to strengthen GPT-5.6's defenses. One technique, Fake Chain-of-Thought, achieved over 95% success against GPT-5.1 but failed to penetrate GPT-5.6. A recent test involved an autonomous vending machine agent, Vendy, which, when manipulated, altered prices and orders.

This illustrates how AI agents can become pathways for data-layer attacks if not properly secured. The research underscores the importance of treating external content as untrusted data and granting agents only the necessary permissions and tools for their intended tasks. Stronger controls and human oversight are crucial for payments, credential use, data exports, access changes, and destructive operations.

OpenAI recommends comprehensive testing of connectors, retrieval systems, uploads, browsing tools, and logs to monitor tool calls, authorization decisions, accessed resources, and unusual privileged action sequences. Despite improved resistance to direct prompt injection, agent security remains contingent upon the permissions and controls governing the model.