OpenAI describes GPT‑Red as an automated red-teaming model designed to identify prompt-injection and other adversarial attacks at scale. The company reports that GPT‑Red was trained with compute comparable to its largest post-training runs and is used to generate adversarial data during model training.
How GPT‑Red works
According to OpenAI, GPT‑Red is trained via self-play: the attacker model seeks to elicit valid failures while a set of defender models are rewarded for resisting attacks and completing their tasks. Training environments specify what GPT‑Red can control—examples include parts of local files, webpage banners, email bodies or tool outputs—and define what counts as a successful attack.
OpenAI says GPT‑Red is kept separate from deployed models so that the specific malicious capabilities it learns remain internal while robustness is instilled into production systems.
Results and case studies
OpenAI reports that using GPT‑Red during training made GPT‑5.6 Sol substantially more resistant to prompt injections. The company states GPT‑5.6 Sol showed six times fewer failures on its hardest direct prompt injection benchmark compared with its best production model four months earlier, and that GPT‑5.6 Sol fails on only 0.05% of GPT‑Red’s direct prompt injections on a broad set of environments.
In benchmark tests described by OpenAI, GPT‑Red found successful attacks in 84% of scenarios on a replicated indirect prompt-injection arena, versus 13% for human red-teamers. OpenAI also reports that a class of “Fake Chain-of-Thought” direct injection attacks that reached up to 95% success on GPT‑5.1 now fall below 10% on GPT‑5.6 Sol.
Real-world case studies in OpenAI’s account include an AI-powered vending-machine agent, where GPT‑Red’s simulated attacks transferred to the live system and achieved three targeted objectives: set an expensive in-stock item to the minimum price of $0.50, order a new $100+ item and offer it for $0.50, and cancel another customer’s order. OpenAI says it disclosed those vulnerabilities and is testing new safeguards. In a separate evaluation, GPT‑Red outperformed a prompted GPT‑5.5 baseline when attacking a Codex CLI agent based on GPT‑5.4 mini across a suite of 10 data-exfiltration tasks.
Deployment and next steps
OpenAI reports that successive GPT releases since GPT‑5.3 have used progressively stronger automated red-teamers during training, producing steady robustness improvements. The company says it will continue to scale compute and data and pursue algorithmic improvements to train future versions of GPT‑Red and apply them to future GPT releases.
Original source: OpenAI News