AI · 105 days ago
A single prompt can now carry an agent from recon to domain access with no human in the loop. That breaks the usual comfort around “one harmless prompt,” because the model can keep choosing the next step once it has tools and access.
Cato Networks showed GPT-5.5 completing a full Active Directory attack chain in a controlled enterprise-like environment, including reconnaissance, exploitation, internal discovery, privilege escalation, lateral movement, and exfiltration, with admin-level privileges reached in about 40 minutes. In parallel, OpenAI says its internal GPT-Red red team keeps finding prompt-injection failures, and that feeding those attacks into training helped GPT-5.6 cut direct injection failures 6x versus GPT-5.5.
For teams wiring LLMs to email, browsers, internal docs, file systems, or admin tools, the risk is the connected environment, not the chat window. A prompt hidden in ordinary content can steer the model into privileged requests or leaks on its own.
4 sources covering this story
OpenAI admits GPT-5.6 occasionally deletes files – but it's an 'honest mistake'
Data purges deemed an example of 'misaligned behavior' that upstart is working to avoid
Single Prompt Enables ChatGPT to Execute Full Cyber-Attack Chain
Cybersecurity researchers tested Open AI GPT 5.5’s offensive cyber capabilities – and the results showed how effective a frontier LLM can be for hackers
OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol
OpenAI says GPT-Red automates prompt injection testing and helped GPT-5.6 Sol record sixfold fewer direct injection failures than GPT-5.5 in benchmark
GPT-Red beat human red teamers on a prompt injection test - Help Net Security
GPT-Red, OpenAI's AI red teamer, beat humans on a prompt injection test and now trains models like GPT-5.6 Sol to resist attacks.
Part of the PlainSec briefing for 2026-07-17