OpenAI built GPT-Red to attack its own models before anyone else does

What OpenAI shipped

OpenAI announced GPT-Red, an internal automated red-teaming system whose only job is to attack OpenAI's own models until it finds a way through them. It isn't a product. It's safety infrastructure — a model trained to find prompt-injection failures in other models, fast enough and broadly enough that human red-teamers can't match its throughput.

The framing OpenAI uses is "self-improvement for robustness": instead of relying solely on human researchers to hand-craft attacks, they're using one generation of models to find the weaknesses in the next generation, before deployment.

How the self-play loop works

GPT-Red is trained with self-play reinforcement learning against a pool of diverse defender models, both sides evolving at once. GPT-Red is rewarded for eliciting a genuine failure — a successful prompt injection, say. The defenders are rewarded for resisting the attack and still completing the task they were given, so the game isn't "refuse everything" — a defender that stonewalls loses points too. Each training environment defines its own threat model: what GPT-Red is allowed to control, and what counts as a win.

As defenders get harder to crack, GPT-Red is pushed to find attacks that are both novel and general, rather than overfitting to one weakness. According to OpenAI, it was trained at the compute scale of some of the company's largest post-training runs — a substantial commitment of resources to a system whose entire purpose is finding flaws, not shipping features.

The numbers

The headline comparison: on indirect prompt injection scenarios against GPT-5.1, GPT-Red found successful exploits 84% of the time, versus 13% for human red-teamers, according to reporting from MarkTechPost. Along the way, GPT-Red discovered a novel attack class OpenAI is calling "Fake Chain-of-Thought" — planting spoofed reasoning traces that lead a model to act on fabricated information it never actually derived. That attack worked more than 95% of the time against GPT-5.1. Against GPT-5.6, hardened using data GPT-Red generated, it dropped below 10%.

On OpenAI's hardest direct-injection benchmark, GPT-5.6 now fails only about 0.05% of the time — roughly six times fewer failures than OpenAI's best production model four months earlier. That's the actual product of this exercise: not a red-teaming demo, but a measurable hardening of the model that ships.

What it still can't do

OpenAI is explicit about the limits. GPT-Red's strength is single-turn, text-based prompt injection. Multi-turn attacks that unfold across a conversation, and image-based injection, still require human red-teamers. And GPT-Red itself will not be released — it's kept internal, separate from any deployed model, for the obvious reason that a capable, purpose-built jailbreak generator is not something you want in the hands of anyone probing your production systems.

My take

The interesting part isn't that OpenAI built an attacker model — adversarial training is old news in ML. It's that they're running it at post-training scale and feeding it directly into the model that ships, rather than treating red-teaming as a pre-launch audit that happens once and gets filed away. That matches what I see building agentic systems in production: the failure modes that matter now aren't chatbot jailbreaks, they're an agent with tool access following an instruction smuggled into a webpage, an email, or a file it was asked to summarize. A 0.05% failure rate sounds small until you remember it's multiplied across every tool call an agentic system makes in a day. Automated, adversarial, continuously-updated red-teaming is the right shape of defense for that threat model — static filters and one-time audits weren't going to keep pace with a system that faces novel injection vectors every time it touches an unfamiliar document. The parts OpenAI still hands to humans — multi-turn and image-based attacks — are exactly where I'd expect the frontier of real-world exploitation to move next.