GPT-Red Red Teamer Makes GPT-5.6 6x Harder to Prompt Inject

An attacker model built for one job

OpenAI has spent one of its largest training runs on a model it does not plan to ship. GPT-Red, which the company described on July 15, 2026, is an automated red-teaming system. Its only job is to find ways to break OpenAI's own models, mainly through prompt injection, so the flaws can be fixed before wider release.112 The company says it trained GPT-Red with about as much compute as some of its largest post-training runs, which it calls an unprecedented amount of compute spent purely on safety.11 An accompanying technical paper goes further. It describes the effort as the largest LLM safety training run ever documented.4

The attacks GPT-Red finds are now part of how OpenAI trains its production models. The company credits that work for GPT-5.6 Sol, which it calls its most prompt-injection-resistant model so far. On OpenAI's hardest direct prompt injection benchmark, Sol has six times fewer failures than the best production model from four months earlier.11

The coverage agrees on the main numbers, mostly because nearly all of them come from OpenAI. Where outlets disagree is on how much weight those numbers can carry. In my reading, GPT-Red is a real methodological step for frontier model evaluation. Its headline claims, however, still need checking by someone other than the company that built both the attacker and the defender.

How the self-play loop works

GPT-Red works roughly the way a human red-teamer does. It sends a prompt, watches how the target model responds and adjusts its approach until it reaches a goal.1 Training uses self-play reinforcement learning. GPT-Red and a varied group of defender models learn at the same time across many red-teaming scenarios. GPT-Red earns reward when it produces a valid failure, and the defenders earn reward when they resist the attack while still finishing their original task.11

That second condition matters. Because defenders are scored on finishing the task, they cannot get through training by simply refusing everything.3 Each environment has its own threat model that sets out what GPT-Red controls and what counts as a win. GPT-Red might control part of a local file, a webpage banner, the body of an email or the output of a tool.11

The technical paper adds detail the blog post leaves out. According to the paper, GPT-Red runs inside an agentic harness that includes a simulated defender tool. It can test variants of an attack before launching one, which the paper presents as more efficient than simple best-of-N sampling.4 The paper also says GPT-Red was trained on jailbreaks that violate content policy, not only on prompt injection.4 It also describes how the attacker's methods changed during training. GPT-Red started with crude lines like "ignore all previous instructions" and later developed fake-reasoning and multimodal tactics.16

By the end of training, OpenAI says, GPT-Red could break almost every model it faced, including internal and production models up to and including GPT-5.5.11

The red teaming results, and what they measure

The most quoted figure is 84% against 13%. OpenAI rebuilt the indirect prompt injection arena from Dziemian et al. (2025) and had GPT-Red and human red-teamers each attack GPT-5.1. On scenarios that were not part of GPT-Red's training, GPT-Red succeeded in 84% of them and the humans in 13%.11

One security writer argued that the number says more about how fragile current models are than about GPT-Red.13 That reading holds up. If an automated attacker can break a recent frontier model in most unfamiliar scenarios, defenses built on fixed benchmarks were weaker than they looked.

On the defense side, the numbers are just as striking. Early versions of GPT-Red found a new kind of attack that OpenAI calls "Fake Chain-of-Thought" injection. It succeeded more than 95% of the time against GPT-5.1 but succeeds less than 10% of the time against GPT-5.6 Sol.11 MarkTechPost explains the trick: the attacker inserts a fake entry into the model's reasoning trace, and the target then acts on information it believes it has already checked.2 The paper puts the same result as robustness rising from 5.2% on GPT-5.1 to 95.9% on GPT-5.6.16

Several of OpenAI's indirect injection benchmarks for developer tools and browsing are now saturated above 97%. GPT-5.6 Sol fails on only 0.05% of GPT-Red's own direct injections.3 OpenAI also says each production model since GPT-5.3 has been trained against progressively stronger predecessors of GPT-Red, and that robustness has improved with each release.1

The 0.05% figure deserves a closer look. Robustness against the attacker you trained on is the easiest kind of robustness to show. RisingStack makes the general point that a model tuned hard against one adversary can still fail against a different model or a skilled human. It also notes that the results are internal and need independent evaluation.7 The six-fold improvement is more convincing because OpenAI reports it on a separate benchmark. OpenAI also says it replayed strong GPT-Red attacks that its models had never seen during training.12

The vending machine test

The most practical evidence comes from the field tests. OpenAI aimed GPT-Red at Vendy, an AI agent built by Andon Labs that runs a vending machine in OpenAI's office. GPT-Red got a description of the system and a simulated copy to practice on. After refining its attacks in simulation, it ran them against the live agent and reached all three of its malicious objectives.1 Those objectives included marking expensive items down to cheap prices and cancelling other customers' orders.11

The paper describes the route in: GPT-Red impersonated an administrator by forging metadata on a Slack message.4 One security analyst called the vending machine experiment the most important part of the research. The reason is that it shows an attacker with only partial knowledge of a system moving from a simulation to a working exploit against a live system.10

In a second test, GPT-Red attacked a Codex CLI agent running on GPT-5.4 mini across 10 held-out data-exfiltration scenarios. It succeeded in more scenarios than a prompted GPT-5.5 baseline and used fewer tokens doing so.1

Accounts of this test do not fully agree. OpenAI's blog post compares GPT-Red with a prompted model baseline.1 A summary of the paper instead says GPT-Red beat human red-teamers in the Codex test.4 Readers should treat the model-baseline comparison as the confirmed one until the full paper settles the question.

Robustness without over-refusal

A model can look safer just by doing less, and OpenAI addresses that directly. The company says it ran both general frontier capability evaluations and over-refusal tests it designed itself. It reports that ordinary capabilities were unaffected while robustness improved.11 Help Net Security reports the same conclusion: capability scores held steady, which suggests the model got better at spotting malicious instructions without turning away legitimate ones.3

The CybersecurityOS analysis singles this out as the part worth respecting. A model that refuses more is not more secure, it argues; it is only following rules more strictly while looking secure.13 I think this is the most important design choice in the whole project. Scoring defenders on task completion is what separates real robustness from refusing everything.

How much 'self-improvement' this really is

OpenAI's headline promises self-improvement, and the company describes a safety flywheel in which today's models make tomorrow's models more robust, aligned and trustworthy.11 That language is doing a lot of work.

RisingStack disputes the framing. It points out that GPT-Red does not rewrite its own code or decide what gets deployed. Researchers still build the environments, define the rewards and choose how the attacks are used. RisingStack calls the system "fuzz testing that can learn," a fuzzer that improves as it runs. That is the more accurate description. The real advance is turning adversarial testing from a one-off check before launch into a continuous step inside training, rather than any form of autonomous self-improvement.7

OpenAI also keeps GPT-Red separate from the models it deploys so the attack skills it trained in do not reach malicious users.11 It has said it will not release the model.2 Every outlet treats that as sensible. The trade-off is that outside researchers cannot directly test the attacker behind the headline numbers.

What GPT-Red still can't do

OpenAI admits clear gaps. GPT-Red still struggles with attacks that depend on a long back-and-forth conversation, where human attackers usually do better. Its ability to exploit image inputs is also still developing. MarkTechPost likewise reports that multi-turn and image-based attacks still need humans.2 OpenAI says it will keep running GPT-Red alongside human and third-party red-teaming, layered safeguards and real-time monitoring.15

For teams building on these models, the security analysts covering the release mostly agree. A more robust model running inside an over-privileged harness that nobody monitors is still easy to attack. Limiting each tool to the access it actually needs protects better over time than waiting for the next model update.13 RisingStack's conclusion is that builders should still assume the model will sometimes be fooled.

The bottom line

GPT-Red is a serious attempt to make safety testing scale as fast as model capabilities. Its most useful result is the evidence that held-out attacks, a live agent and capability checks all point in the same direction. Its weakest point is that OpenAI designed the attacker, the defenders, the benchmarks and the grading, and the attacker will stay inside the company. Until outside groups reproduce the results, GPT-Red is best read as a convincing proof of concept. It does not yet show that prompt injection is solved.