Report details GPT-6 Astra prompt-injection limits

GPT-6 Astra blocked 99.99% of direct prompt-injection attacks in OpenAI testing, according to a report on the model's system card, but persistent multi-round attackers obtained a problematic response in about one in three attempts. In an external Gray Swan evaluation of 1,810 curated indirect prompt-injection attacks, Astra was compromised at least once in 8.5% of scenarios with 15 attempts, down from 27% for GPT-5.6 Sol. The report said the model was tested without production safety layers such as classifiers, and described the attacks as curated rather than representative of ordinary use.