OpenAI has disclosed an internal automated red‑teaming model, GPT‑Red, that the company says can scale discovery of prompt injection vulnerabilities and feed those findings back into training. The stated aim is to find and fix prompt‑injection failure modes before models and connected agents are widely deployed.
GPT‑Red's red‑teaming method
OpenAI describes GPT‑Red as operating like a human red‑teamer: it sends prompts, observes how a target GPT model responds, and iterates toward a malicious objective such as exporting sensitive data to an external server. The company says GPT‑Red is trained with self‑play reinforcement learning, where the red‑teamer and a set of diverse defender LLMs are trained simultaneously on a broad set of red‑teaming scenarios.
Under that training scheme, GPT‑Red is rewarded for eliciting a valid failure — for example, a successful prompt injection — while defender models are rewarded for resisting the attack and completing their original tasks. OpenAI emphasized that GPT‑Red is kept separate from other models so that the malicious capabilities it develops are not exposed to outside actors.
How GPT‑Red changed GPT‑5.6 Sol's robustness
OpenAI says it integrated GPT‑Red directly into the training process for GPT‑5.6 Sol, producing what the company calls its most robust model to prompt injections to date. By this measure, GPT‑5.6 Sol achieves six‑times fewer failures on a direct prompt injection benchmark than GPT‑5.5, the company’s frontier model from four months earlier.
OpenAI reported that several indirect prompt‑injection benchmarks targeting developer tools and browsing have been "saturated" by the latest model, with greater than 97% accuracy. On a broad set of robustness environments, GPT‑Red’s own attack success rates have fallen monotonically over time; OpenAI said GPT‑5.6 Sol fails on only 0.05% of GPT‑Red’s direct prompt injections.
Case studies: Andon Labs vending machine and Codex command‑line agent
OpenAI provided concrete examples of GPT‑Red’s activities. In one real‑world test the company targeted an AI‑based vending machine built by Andon Labs. After practicing in simulation, GPT‑Red met three goals: lowering the price of an expensive item to the minimum allowed price of $0.50, ordering a new $100 item for that same amount, and canceling another customer's order. OpenAI said it followed responsible disclosure and that fresh safeguards are being tested.
In a second study, GPT‑Red attacked a Codex command‑line agent based on GPT‑5.4 mini across 10 held‑out data‑exfiltration tasks. OpenAI reported that GPT‑Red caused sensitive data to be transmitted in more cases than a prompted GPT‑5.5 baseline.
New attack classes found — and mitigations
An early version of GPT‑Red uncovered what OpenAI calls a novel class of direct prompt injection attacks: Fake Chain‑of‑Thought (CoT) attacks. Those attacks reportedly achieved success rates north of 95% on GPT‑5.1 but are now below 10% for GPT‑5.6 Sol. OpenAI also stated that GPT‑Red generated successful attacks against GPT‑5.1 in more scenarios than human red‑teamers when it came to indirect prompt injections.
OpenAI says the adversarial training loop forces the red‑teamer back to "the drawing board" as defender models grow more robust, implying an ongoing cycle of attack discovery and defense hardening driven by automated testing.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Automated red‑teaming can scale discovery of prompt injection failure modes beyond what human testers alone can find. Teams embedding agents into browsers, apps, local files, or tools should expect to incorporate adversarial training and continuous robustness evaluation into development workflows, the company’s disclosures imply.
- Policymakers and regulators: OpenAI’s practice of keeping GPT‑Red separate from production models and applying responsible disclosure in vendor tests highlights governance choices about confinement and disclosure of automated offensive capabilities that regulators may scrutinize.
- Affected enterprises and procurement leaders: The Andon Labs and Codex examples underscore concrete risks for systems that connect models to third‑party data sources; procurement decisions should reflect the potential for prompt injections to affect payments, credential handling, order processing, and data exfiltration.
The disclosure accompanies another candid finding from OpenAI: an audit of SWE‑Bench Pro showed roughly 30% of tasks are broken, prompting the company to retract a prior recommendation to adopt that benchmark for measuring frontier coding capabilities. OpenAI’s datapoint analysis pipeline flagged 200 (27.4%) broken tasks, while a human annotation campaign identified 249 (34.1%). Earlier in February, the company said it was moving away from SWE‑bench Verified because of fundamental design and contamination issues.
OpenAI’s account sketches an evolving security posture: an automated attacker that can outpace human testers in some scenarios, a defensive training loop that measurably reduces a model’s susceptibility, and an ongoing need to vet both benchmark quality and operational safeguards. The company’s work raises a practical question it has already begun answering internally — how to keep powerful red‑teaming tools effective for defenders while preventing their misuse — and it leaves open who outside the company will verify those claims and the benchmark corrections that follow.
