{"schema_version":"0.10.0","id":"LR-2026-0319","record_version":1,"title":"Sora 2 audio output leaks hidden system prompt (Mindgard research, November 2025)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":57.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"8f5531f344aedfd6a4d5a0b5c8f855868267a120c30c2657d119f35cb0b1bf00"},"system":{"model_name":"Sora 2","model_version":null,"developer":"OpenAI","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-11-12","incident_class":"other","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Mindgard, a company specialising in AI security testing, researched OpenAI's Sora 2 video generator. Researchers asked the model to speak short parts of its system prompt as audio, transcribed the speech, and stitched the fragments into a nearly complete set of its foundational instructions, which define its safety limits and operational guidelines. The research began on November 3, 2025 and was published on November 12, 2025. The recovered rules included avoiding sexually suggestive content. OpenAI acknowledged the issue after the disclosure. The sources describe the prompt itself as posing low immediate risk, though the technique could expose tools or agent integrations. Mindgard advises treating system prompts as secret settings and testing audio and video outputs for leaks.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"Test: no effect beyond the system itself. Fact: the source says the prompt itself poses low immediate risk.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://hackread.com/mindgard-sora-2-vulnerability-prompt-via-audio/","publisher":"Hackread","date":"2025-11-12","type":"press","title":"Mindgard Finds Sora 2 Vulnerability Leaking Hidden System Prompt via Audio - Hackread","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://cybersecuritynews.com/openai-sora-2-vulnerability/","publisher":"CyberSecurityNews","date":"2025-11-13","type":"press","title":"OpenAI Sora 2 Vulnerability Exposes System Prompts via Audio Transcripts - CyberSecurityNews","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.developer":"C","event.date_disclosed":"C","event.detection_method":"C","impact.severity":"C","event.incident_class":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":1,"quote":"A vulnerability in OpenAI’s advanced video generation model, Sora 2, that enables the extraction of its hidden system prompt through audio transcripts, raising concerns about the security of multimodal AI systems."}],"system.developer":[{"source_index":0,"quote":"AI security firm Mindgard discovered a flaw in OpenAI’s Sora 2 model, forcing the video generator to leak its system prompt through audio transcripts."}],"event.date_disclosed":[{"source_index":1,"quote":"The findings, published on November 12, 2025, highlight ongoing challenges in protecting AI models from prompt leakage, even as companies invest heavily in red-teaming and alignment training."}],"event.detection_method":[{"source_index":0,"quote":"AI security firm Mindgard discovered a flaw in OpenAI’s Sora 2 model, forcing the video generator to leak its system prompt through audio transcripts."}],"impact.severity":[{"source_index":1,"quote":"While Sora 2’s prompt itself poses low immediate risk, the technique could apply to more sensitive targets, potentially exposing tools or agent integrations."}],"event.incident_class":[{"source_index":1,"quote":"A vulnerability in OpenAI’s advanced video generation model, Sora 2, that enables the extraction of its hidden system prompt through audio transcripts, raising concerns about the security of multimodal AI systems."}],"impact.severity_because":[{"source_index":1,"quote":"While Sora 2’s prompt itself poses low immediate risk, the technique could apply to more sensitive targets, potentially exposing tools or agent integrations."}],"event.summary":[{"source_index":1,"quote":"A vulnerability in OpenAI’s advanced video generation model, Sora 2, that enables the extraction of its hidden system prompt through audio transcripts, raising concerns about the security of multimodal AI systems."},{"source_index":0,"quote":"Asking Sora 2 to speak short parts of the prompt allowed them to use transcripts to piece together a nearly complete set of foundational instructions."},{"source_index":0,"quote":"This research, shared with Hackread.com, began on November 3, 2025, and was published on November 12, 2025."},{"source_index":1,"quote":"OpenAI acknowledged the issue after Mindgard’s disclosure, noting general awareness of prompt extraction but requesting a draft review before publication."},{"source_index":1,"quote":"While Sora 2’s prompt itself poses low immediate risk, the technique could apply to more sensitive targets, potentially exposing tools or agent integrations."},{"source_index":0,"quote":"To address this, Mindgard provided key advice– AI builders should treat system prompts as secret settings, test audio/video outputs for leaks, and limit response length."}]},"notes_on_gaps":"Sources are press coverage only; no OpenAI or Mindgard primary report is quoted beyond these articles. No model version, deployment context, lifecycle stage, harness, tools or permissions were stated. No direct loss, records, affected parties or durations were stated. The date the leak itself occurred is not stated, so date_occurred is omitted; 2025-11-03 is only the date research began. Detection date is not stated. No trigger or adversarial actor is stated; the researchers were external red-teamers, but the sources do not label them an attacker. agent_involved is set to false as judgement: no autonomous agent is described. incident_class other is a judgement because no listed class fits prompt leakage. root_cause guardrail and the D1 failed link are judgements drawn from the sentence about safety training. The OpenAI fix or remediation is not stated; only OpenAI's acknowledgement is reported. Mindgard's advice is mapped to C4 and I1 by judgement. Severity negligible is a judgement from the source's statement that the prompt itself poses low immediate risk. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Sora 2 leaked its system prompt through audio transcripts.","quote":"AI security firm Mindgard discovered a flaw in OpenAI’s Sora 2 model, forcing the video generator to leak its system prompt through audio transcripts.","source_index":0,"grade":"C"},{"step":"reached","text":"Researchers stitched transcribed audio fragments into a near-complete system prompt.","quote":"The breakthrough came with audio: by prompting Sora 2 to generate speech in short, 15-second clips often sped up to fit more content, researchers transcribed outputs with high fidelity, stitching fragments into a near-complete system prompt.","source_index":1,"grade":"C"},{"step":"caught","text":"The flaw was found by Mindgard, an outside AI security firm.","quote":"AI security firm Mindgard discovered a flaw in OpenAI’s Sora 2 model, forcing the video generator to leak its system prompt through audio transcripts.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://hackread.com/mindgard-sora-2-vulnerability-prompt-via-audio/","https://cybersecuritynews.com/openai-sora-2-vulnerability/"]},"analysis":{"sections":{"timeline":[{"text":"Mindgard began experimenting with Sora 2.","quote":"Mindgard’s team, led by Aaron Portnoy, began experimenting with Sora 2 on November 3, 2025, exploring how semantic drift in multimodal transformations could expose the model’s foundational rules.","source_index":1,"when":"2025-11-03"},{"text":"Findings on the system prompt leak were published.","quote":"This research, shared with Hackread.com, began on November 3, 2025, and was published on November 12, 2025.","source_index":0,"when":"2025-11-12"},{"text":"OpenAI acknowledged the issue after the disclosure.","quote":"OpenAI acknowledged the issue after Mindgard’s disclosure, noting general awareness of prompt extraction but requesting a draft review before publication.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://hackread.com/mindgard-sora-2-vulnerability-prompt-via-audio/","https://cybersecuritynews.com/openai-sora-2-vulnerability/"]}}