Researchers Reveal GPT-5.5 Vulnerable to Hidden Prompt Injection via API Relays
Key Takeaways
- ▸Hidden system prompts can shift GPT-5.5's behavioral fingerprint by 0.46 (Jensen-Shannon distance), making it appear as a completely different model
- ▸GPT-5.5 is sensitive to prompt length alone, drifting significantly even with meaningless padding, while gpt-4o-mini resists padding-based interference
- ▸Real captured system prompts (e.g., Claude Code's 6,651-token block) cause radical output shifts including language switching and entropy collapse
Summary
Security researchers have demonstrated that GPT-5.5 endpoints can be manipulated through injected system prompts carried by relay services and aggregators, fundamentally altering the model's behavioral fingerprint. By probing a pinned GPT-5.5 endpoint with over 5,600 controlled API calls, the team discovered that hidden prompts can shift the model's fingerprint by a Jensen-Shannon distance of 0.46—enough to make it behaviorally indistinguishable from a different model entirely. Real system prompts from tools like Claude Code (6,651 tokens) caused GPT-5.5's random-color distribution to collapse to a single color and shifted language outputs to Chinese, while meaningless padding alone moved the model's fingerprint by 0.355. The research reveals that this interference is not random but follows predictable, measurable patterns that vary by model, probe task, and injection type—creating both a vulnerability for API consumers and a potential defense mechanism through fingerprinting.
- The interference patterns are lawful and measurable across different models and probe tasks, enabling both detection and defense strategies
Editorial Opinion
This research exposes a critical vulnerability in the API relay and aggregator ecosystem that many enterprises rely on for load balancing and cost optimization. While the fingerprinting technique itself is valuable for detecting model substitution attacks, the finding that real system prompts can completely mask a model's identity raises uncomfortable questions about the trustworthiness of third-party API intermediaries. OpenAI and other providers should consider this evidence when evaluating the security posture of their supply chain—and API consumers should demand transparency about what hidden context is being injected into their requests.
