OpenAI has developed an internal automated red‑teaming model called GPT‑Red, intended to find prompt‑injection and other adversarial vulnerabilities at scale and to produce adversarial examples used during model training. The company says automated red‑teaming lets safety testing keep pace with rapidly advancing model capabilities.
Why develop an automated red‑teamer?
Red‑teaming—deliberate, adversarial testing—is essential for discovering vulnerabilities and improving model robustness, but human‑only red‑teaming does not scale easily. Designing and running human exercises is time‑intensive, which limits the volume and diversity of adversarial examples available for robustness training. In addition, some commonly used robustness evaluations have become saturated by the latest models and no longer reveal new failure modes.
How GPT‑Red works
GPT‑Red operates similarly to a human red‑teamer: it pursues malicious goals by sending prompts, observing model responses, and iterating. OpenAI trained GPT‑Red using substantial compute—described as comparable to some of their largest post‑training runs—devoting that compute explicitly to safety improvement.
Training used self‑play: GPT‑Red is rewarded for eliciting valid failures (for example, successful prompt injections), while a population of defender models are rewarded for resisting attacks and completing their tasks. The training environments are diverse and realistic, specifying threat models that define what parts of a context GPT‑Red can control (parts of a local file, a webpage banner, an email body, or tool output) and what constitutes a successful attack.
Key results reported
- GPT‑Red was incorporated directly into production model training; OpenAI reports that GPT‑5.6 Sol is now their most robust model against prompt injections.
- On their hardest direct prompt‑injection benchmark, GPT‑5.6 Sol produced 6× fewer failures than their best production model from four months earlier.
- In a replicated indirect prompt‑injection arena from Dziemian et al. (2025), GPT‑Red achieved successful attacks in 84% of scenarios versus 13% for human red‑teamers when attacking GPT‑5.1 on environments distinct from GPT‑Red’s training data.
- A class of direct prompt‑injection attacks called "Fake Chain‑of‑Thought" previously reached success rates above 95% on GPT‑5.1; those attack rates are now under 10% on GPT‑5.6 Sol.
- Several indirect prompt‑injection benchmarks (targeting developer tools and browsing) are effectively saturated on the latest model (>97% accuracy).
- Overall, GPT‑Red’s attack success rates against improving production models have declined over time; GPT‑5.6 Sol fails only 0.05% of GPT‑Red’s direct prompt injections on a broad set of robustness environments.
Tests against real and simulated systems
OpenAI evaluated GPT‑Red in varied settings:
- In a test against a real office vending‑machine agent (Vendy), GPT‑Red developed attacks in simulation and transferred them to the live agent, successfully causing the agent to change expensive items to cheap and cancel other customer orders. OpenAI disclosed these vulnerabilities and is testing new safeguards.
- Against a Codex CLI agent backed by GPT‑5.4 Mini, GPT‑Red was tested on a held‑out suite of 10 data‑exfiltration scenarios. It was both more effective—eliciting exfiltration in more scenarios—and more token‑efficient than a prompted GPT‑5.5 baseline.
Safety controls and limitations
OpenAI keeps GPT‑Red separate from deployed models to prevent the specific malicious capabilities trained into GPT‑Red from being exposed to adversaries. The company’s stated aim is to use GPT‑Red to generate adversarial training data for future models, thereby improving robustness.
OpenAI also emphasizes that improving safety should not be conflated with reducing model capability by default. Their evaluations show that normal capabilities remained unaffected while robustness to malicious instructions improved, indicating gains came from better resistance to adversarial prompts rather than broad refusal or capability degradation.
Next steps
OpenAI intends to continue scaling GPT‑Red—adding more compute, data, and algorithmic improvements—to train stronger automated red‑teamers. These models will be used alongside human and third‑party red‑teaming, layered safeguards, and real‑time monitoring. The company said it will release a preprint with further technical details later this week.
Brief summary
GPT‑Red is an internal automated red‑teamer designed to find and generate adversarial attacks at scale. Integrated into model training, it helped reduce prompt‑injection failures substantially in GPT‑5.6 Sol, and OpenAI plans to continue scaling the approach while publishing more details soon.
