OpenAI Sora 2 Vulnerability Allows Exposure of Hidden System Prompts from Audio Data

Security researchers have demonstrated a cross‑modal vulnerability in OpenAI’s Sora 2 video generation model, showing that hidden system prompts can be exposed from audio data. The researchers found that by chaining cross‑modal prompts and careful framing, they could surface instructions that define the model’s behaviour and guardrails, with audio transcription proving the most effective extraction method.

Sora 2 is described as a state‑of‑the‑art multimodal model for generating short video content, and it was thought to keep its system prompts secure, but the study shows semantic drift across the data transformations from text to image, video and finally audio can surface small fragments that can be stitched together.

The successful approach relied on stepwise extraction of tiny token sequences across many frames, using 15‑second audio clips to achieve higher fidelity than visual methods, and then assembling these fragments with transcription or OCR. This highlights fundamental challenges in securing multimodal AI systems, and researchers urge treating system prompts as configuration secrets rather than harmless metadata. according to OpenAI.