GPT-OSS-120B IPI Assessment

Executive Summary

GPT-OSS-120B demonstrated 8% overall susceptibility to indirect prompt injection attacks across 250 test cases (20 susceptible, 230 resistant). Vulnerabilities concentrate in 4 of 25 IPI classes: IPI-010 (40%), IPI-019 (40%), IPI-021 (30%), and IPI-022 (30%).

Susceptibility Rate

20 of 250 cases

Critical Severity

10%

12 of 120 critical cases

High Severity

8 of 100 high cases

Vulnerable Classes

of 25 IPI classes

Variant Analysis

Susceptibility varies by delivery method. Direct attacks (9%) and obfuscated payloads (9.3%) succeed at similar rates, while embedded attacks are significantly less effective (5.3%).

Variant	Susceptible / Total	Rate
Direct	9 / 100	9%
Obfuscated	7 / 75	9.3%
Embedded	4 / 75	5.3%

IPI Class Breakdown

Most IPI classes (21 of 25) showed 0% susceptibility. Four classes exhibited measurable vulnerability:

IPI-010 (40%) — 4 of 10 cases susceptible. Critical severity concentration. Architecture-specific pattern.
IPI-019 (40%) — 4 of 10 cases susceptible. Critical to high severity. Behavioral override patterns.
IPI-021 (30%) — 3 of 10 cases susceptible. Mixed severity. Instruction framing variations.
IPI-022 (30%) — 3 of 10 cases susceptible. Mixed severity. Role boundary exploitation.

The remaining 21 classes (IPI-001 through IPI-009, IPI-011 through IPI-018, IPI-020, IPI-023 through IPI-025) showed complete resistance across all test variants.

Severity Distribution

Critical-severity tests (120 cases) showed 10% susceptibility (12 susceptible). High-severity tests (100 cases) showed 8% (8 susceptible). Medium and lower-severity tests showed 0% susceptibility.

This pattern suggests the model's vulnerabilities are concentrated in adversarially complex scenarios rather than trivial attack variations. The distinction has architectural implications: filtering cannot be bypassed by simply raising severity thresholds.

Structural Findings

Detailed architectural analysis of each vulnerable class identifies the following root causes:

Context window parsing — IPI-010 and IPI-019 exploit how the model parses instruction boundaries within long context windows.
Role bleed — IPI-021 and IPI-022 succeed when instructions explicitly define role constraints but fail to isolate behavioral overrides.
Obfuscation bypass — Direct and obfuscated variants show similar rates, suggesting the model's filter is not robustly position-invariant.

Responsible disclosure: This assessment follows structural disclosure principles. Specific adversarial payloads are withheld. Details sufficient for defensive validation (mock patterns, test harnesses, architectural root causes) are disclosed to support defensive engineering and internal validation in production systems.

Conclusion

GPT-OSS-120B demonstrates strong baseline resistance to IPI attacks (92% resistant overall). However, measurable vulnerabilities exist in specific architectural scenarios (4 of 25 IPI classes). These vulnerabilities are not defects in isolation — they reflect trade-offs between model expressiveness and robustness that are common across language models operating at this scale and architecture.