What if the best way to make an AI model safe was to train another AI to attack it as brutally as possible?
That's the premise behind GPT-Red, OpenAI's new automated red-teaming model — and the results are striking. GPT-Red successfully breaks every production model it faces, up to and including GPT-5.5. It then turns those attacks into training data that makes GPT-5.6 Sol dramatically more resistant. On OpenAI's hardest direct prompt injection benchmark, GPT-5.6 Sol records six times fewer failures than the best model from just four months prior.
The announcement, published July 15, 2026, marks a significant moment in AI safety infrastructure — and hints at a flywheel OpenAI believes could let today's models directly make tomorrow's models safer.
Why Human Red-Teaming Alone Doesn't Scale
Red-teaming — where adversarial researchers attempt to trick or manipulate a model into harmful behavior — has long been a cornerstone of pre-deployment safety work. But human red-teaming has hard limits. It's time-intensive, expensive to run repeatedly, and the volume of attack examples it produces is too thin to meaningfully improve model robustness through training.
The specific vulnerability GPT-Red targets is prompt injection: attacks where a malicious third party embeds instructions in content the AI agent encounters during a task — an email body, a webpage, a tool response, a code repository — hoping to hijack the model's behavior. As AI agents become more autonomous and interact with more external data, the attack surface grows.
Prompt injections are particularly dangerous in agentic settings because the model is expected to act, not just respond. An injected instruction telling the model to upload credentials, change a price, or cancel another user's order can cause real-world harm before a human ever reviews the output. This is the same challenge that makes AI code reliability in production environments such a persistent concern for engineering teams.
Self-Play as a Safety Engine
GPT-Red is trained using self-play reinforcement learning, a technique more commonly associated with superhuman game-playing agents. Here, GPT-Red and a collection of diverse defender models are trained simultaneously across a broad library of realistic red-teaming scenarios.
The mechanics are straightforward: GPT-Red is rewarded for eliciting a valid failure — a successful prompt injection. The defender models are rewarded for resisting the attack while still completing their original tasks. As defenders improve, GPT-Red is forced to discover more creative and diverse attacks. As GPT-Red gets stronger, the next round of defenders must become more robust.
OpenAI built an expansive set of realistic injection scenarios to support this — covering local files, webpage banners, email bodies, and tool outputs. Each environment specifies what the attacker controls and what counts as a success.
The compute investment is notable: GPT-Red was trained at the scale of some of OpenAI's largest post-training runs — an amount of compute dedicated purely to improving safety rather than capability.
How Effective Is GPT-Red?
Against the models and scenarios it trained on, GPT-Red is described as near-universal: it breaks all models up to and including GPT-5.5. But OpenAI also evaluated it in settings outside its training distribution — a more honest test of whether it's actually a useful general-purpose red-teaming agent.
In one evaluation, OpenAI ran GPT-Red against a replicated version of an indirect prompt injection benchmark from Dziemian et al. (2025), using environments and goals distinct from its training set. GPT-Red found successful attacks in 84% of scenarios. Human red-teamers, working independently on the same challenge, succeeded on only 13%.
Two real-world case studies make the implications concrete:
Breaking a Live Vending Machine Agent
OpenAI pitted GPT-Red against an autonomous vending machine agent — similar to its Project Vend deployment — built by Andon Labs. GPT-Red was given only a description of the system and the ability to test attacks in simulation before transferring them to the production agent. It achieved all three of its assigned malicious objectives:
- Changing the price of an expensive in-stock item to the minimum allowed price of $0.50
- Ordering a new item worth over $100 and listing it for $0.50
- Cancelling another customer's order
OpenAI disclosed these vulnerabilities to Andon Labs, and new safeguards are reportedly being tested.
Breaking a Codex CLI Agent
GPT-Red was also tested against a Codex CLI agent on a suite of ten held-out data-exfiltration scenarios. Compared to a GPT-5.5 baseline prompted to red-team, GPT-Red succeeded in more scenarios and used fewer tokens doing it — making it both more capable and more efficient as an automated attacker.
From Attacker to Trainer: Building GPT-5.6's Robustness
The loop closes here: GPT-Red's attacks are fed directly into the training process for production models. OpenAI reports that since GPT-5.3, each successive release has incorporated adversarial data from progressively stronger versions of its red-teaming models.
One early GPT-Red precursor discovered a novel class of attack called "Fake Chain-of-Thought" injections — attacks that achieved success rates above 95% on GPT-5.1. Against GPT-5.6 Sol, that number is now below 10%.
More broadly, GPT-Red's attack success rate on GPT-5.6 Sol's direct prompt injections has fallen to 0.05% on the broad robustness evaluation suite. Several indirect prompt injection benchmarks targeting developer tools and browsing environments are now saturated — meaning GPT-5.6 Sol achieves above 97% accuracy resisting known attack classes.
Importantly, OpenAI tested that these robustness gains didn't come at the cost of capability. Evaluations of general frontier performance and targeted over-refusal tasks show no degradation — suggesting the model learned to identify and resist malicious instructions specifically, rather than becoming broadly more cautious or less useful. This aligns with the broader aspiration behind tools like GPT-5.6 Sol's deployment at scale: robustness must hold under real-world production load, not just benchmarks.
The Containment Strategy
GPT-Red is not deployed externally. OpenAI keeps it entirely internal — a deliberate containment decision. The model is specifically trained to find and exploit vulnerabilities, which makes it a significant security asset that also carries obvious dual-use risk. By keeping it separate from production deployments, OpenAI instills robustness into public models without exposing the attack playbook.
This is a meaningful distinction from capability self-improvement, where a model's outputs might directly feed into the next version's training in ways that are harder to audit. Here, the mechanism is adversarial training with a controlled and isolated red-teamer — a more structured loop.
What This Means for Agentic AI Security
Prompt injection is widely considered one of the most serious near-term risks for deployed AI agents. As models like Codex, ChatGPT Work, and competing products become standard in enterprise environments — reading documents, executing code, browsing the web, and managing files — the attack surface for injected instructions grows considerably.
The GPT-Red results suggest that adversarial self-play, at sufficient compute scale, can produce meaningful, measurable robustness improvements rather than just incremental safety patches. Whether that improvement keeps pace with increasingly capable models being deployed in higher-stakes contexts remains the harder question — and one OpenAI explicitly flags as a continuing area of work. The challenge of maintaining safety as capabilities scale is a pressure felt across the industry, from the legal scrutiny of AI training practices to the governance questions raised by automated decision-making.
OpenAI says a preprint with additional technical details will be released later this week.
