GPT-6 Astra hallucinates less, still vulnerable to hidden prompt injections

OpenAI's GPT-6 Astra marks a step forward in AI safety, particularly in reducing hallucinations and resisting direct attacks. However, its vulnerability to indirect prompt injections—where malicious instructions are hidden in documents an AI reads—highlights a significant challenge for deploying AI agents in secure enterprise environments. The article notes that these tests were run on the bare model without production safety layers, suggesting that real-world defenses might be stronger.

The reported numbers indicate a trade-off. Astra's near-perfect defense against direct prompt injections (99.99 percent) contrasts sharply with its 8.5 percent failure rate against indirect attacks in external testing. This gap suggests that while the model is well-hardened against user manipulation, it remains susceptible to attacks that exploit its interaction with external content. The article also points out that previous test results were based on easier datasets and different testing conditions, which makes direct comparisons difficult.

The implications for businesses are clear: AI agents that read and process documents as a core job could be a significant attack surface. As these agents are deployed at scale, the risk of such attacks grows. The article advises that enterprises should be cautious, noting that while Astra is an improvement, it is not yet reliable enough for fully secure AI agent deployments.