AI Risk Wire

Cases › other › LR-2026-0319

Sora 2 audio output leaks hidden system prompt (Mindgard research, November 2025)

Confirmed Why: 2 independent outlets · 2 independent reports

Status: no action reported

Severity negligible
Reported 12 Nov 2025
Developer and model OpenAI · Sora 2

No source states: loss or records, agent tool, could do, deployer, industry.

Severity negligible: Test: no effect beyond the system itself. Fact: the source says the prompt itself poses low immediate risk.

Mindgard, a company specialising in AI security testing, researched OpenAI's Sora 2 video generator. Researchers asked the model to speak short parts of its system prompt as audio, transcribed the speech, and stitched the fragments into a nearly complete set of its foundational instructions, which define its safety limits and operational guidelines. The research began on November 3, 2025 and was published on November 12, 2025. The recovered rules included avoiding sexually suggestive content. OpenAI acknowledged the issue after the disclosure. The sources describe the prompt itself as posing low immediate risk, though the technique could expose tools or agent integrations. Mindgard advises treating system prompts as secret settings and testing audio and video outputs for leaks.

What happened

1 · What went wrongSora 2 leaked its system prompt through audio transcripts.
2 · What it reached or didResearchers stitched transcribed audio fragments into a near-complete system prompt.
3 · How it was caughtThe flaw was found by Mindgard, an outside AI security firm.

What was done

No source states an action or fix.

Risks

Not yet sorted into a risk

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Similar incidents

ChatGPT-written Game of Thrones fanfic prompts George R.R. Martin lawsuit2025-11-12
Tenable finds seven ChatGPT vulnerabilities enabling data leaks and persistent hijacking2025-11-05
University of Washington study demonstrates cross-origin data theft via prompt injection in ChatGPT Atlas Agent Mode2026-10-29
ChatGPT deletes two years of a professor's research2026-01-25

All cases of this kind ›

Evidence

No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 3 items from the primary sources

What happened, in order

  1. 2025-11-03 Mindgard began experimenting with Sora 2.
  2. 2025-11-12 Findings on the system prompt leak were published.

Not dated in the sources:

  • OpenAI acknowledged the issue after the disclosure.
Show every field, with its source and grade

The AI system

Model
Sora 2
C one secondary source states it
Developer
OpenAI
C one secondary source states it

What happened

Earliest source we hold
2025-11-12
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
What went wrong
other
D inferred by us from the described behaviour, reason shown

Impact

Severity
negligible
C one secondary source states it
Why this severity
Test: no effect beyond the system itself. Fact: the source says the prompt itself poses low immediate risk.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Sources are press coverage only; no OpenAI or Mindgard primary report is quoted beyond these articles. The OpenAI fix or remediation is not stated; only OpenAI's acknowledgement is reported.

LR-2026-0319 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON