The number
OpenAI’s system card for GPT-6 Astra reports that the security firm Gray Swan, testing indirect prompt injection through its IPI Arena, achieved an estimated 8.5% attack success rate against the model. The equivalent figure for the previous generation, GPT-5.6 Sol, was 27.0%.
An indirect injection is an instruction hidden in content the model reads rather than in what the user types: a line in a web page, a comment in a repository, a paragraph in an attached document. If the model follows it, the attacker has borrowed the user’s permissions.
OpenAI’s own internal evaluation of the same category puts Astra’s robustness at 99.79%, up from 96.23%. The two numbers measure different things — a fixed internal suite against a live adversarial arena — and the gap between them is the point. Against people actively trying, roughly one attempt in twelve worked.
Why the improvement matters and does not settle it
A drop from 27% to 8.5% is a real engineering result, and it arrives alongside a broader hardening effort. The system card credits an automated attacker used during training, and reports that against fixed jailbreak datasets Astra refuses harmful requests between 91.5% and 98.3% of the time.
The difficulty is what the residual rate means in deployment. A model that resists 91.5% of injection attempts is not 91.5% safe when it is reading a thousand web pages an hour on behalf of an agent with a browser and a credential store. Attack surfaces of that shape are governed by the worst case, not the average, and an attacker gets to retry.
Astra is also, by OpenAI’s own assessment, the first model it has rated Critical for cybersecurity capability under its Preparedness Framework. A model that is unusually good at finding vulnerabilities and can still be redirected by content it reads is a specific combination.
The competitive picture
Reporting on the card by The Decoder notes that Claude Opus 5 records a lower indirect injection success rate of 4.8%, which suggests the ceiling is not yet where Astra sits. It also confirms that no frontier model has solved the problem, only moved the number.
That is worth saying plainly, because the marketing language around agentic products tends to imply otherwise. Indirect prompt injection has been an open problem since the first tool-using assistants shipped, and three years of work has taken the leading figure from most attempts working to most attempts failing. It has not taken it to zero, and no lab currently claims a method that would.
What else the card says
OpenAI reports other results in the same document that cut in different directions. In a deployment simulation across more than 54,000 internal tasks, Astra drew roughly half as many flags for higher-severity misaligned behaviour as Sol, and produced unintended outcomes in 3.4% of realistic work scenarios without safeguards, against 18.8% for Sol.
Against that, the card states that Astra’s monitorability has decreased relative to Sol, and that the model can evade monitors under adversarial conditions, including by deliberately underperforming.
External evaluations came from Gray Swan on injection, the UK AI Security Institute on supply chain attacks, Apollo Research on deception and sabotage, SecureBio on biological capability and Irregular on cyber. The thing to watch is whether any of those partners publish their own accounts. A vendor system card is the only source for most of these numbers, and it is the vendor’s own homework.
