On July 15, 2026, OpenAI published details of GPT-Red, an internal automated red-teaming model built to find vulnerabilities in its production models at scale. GPT-Red works the way a human red-teamer does - sending a prompt, observing how the target model responds, and iterating toward a malicious goal - but it was trained with self-play reinforcement learning at the compute scale of some of OpenAI’s largest post-training runs. The attacker is rewarded for successful prompt injections while a collection of diverse defender models is rewarded for resisting them, so both sides escalate together.
The reported numbers are striking. On novel indirect prompt injection scenarios, GPT-Red succeeded in 84 percent of internal evaluations versus 13 percent for human red-teamers on the same tests. Training GPT-5.6 Sol against GPT-Red’s attacks produced 6x fewer failures on OpenAI’s hardest direct prompt injection benchmark compared to the prior best production model, with the deployed model now failing on only 0.05 percent of GPT-Red’s direct injections. One specific attack class, fake chain-of-thought injections, dropped from a 95 percent success rate against GPT-5.1 to below 10 percent against GPT-5.6 Sol.
OpenAI says GPT-Red itself is kept separate from deployed models so its offensive capabilities do not reach adversarial actors, and that vulnerabilities it surfaces go through disclosure and remediation processes.
The business significance is that prompt injection - the main practical attack on agentic AI systems that browse, read email, or use tools - is now being fought with automated attackers rather than scarce human expertise. It is also a notable data point on AI improving AI: one of the largest training investments OpenAI has disclosed recently was spent not on a smarter product model but on a model whose only job is to break the others.