GPT-Red

GPT-Red is OpenAI's internal (internal-only, never released) model published on 15 July 2026 in the blog "GPT-Red: Unlocking Self-Improvement for Robustness". It is OpenAI's most advanced automated safety red-teaming model — a model whose job is to attack OpenAI's own models and find prompt injection vulnerabilities. Core thesis: human red-teaming does not scale (it is time-intensive and limits the pace of discovering new failure modes), commonly used robustness evaluations are already saturated by the latest models, so safety must scale alongside model capabilities. OpenAI keeps GPT-Red separate from deployed customer models — malicious capabilities specifically trained into GPT-Red must not fall into the hands of adversarial actors.

Self-play reinforcement learning training: GPT-Red together with a collection of diverse defender LLMs trains simultaneously on a broad set of red-teaming scenarios. GPT-Red is rewarded for eliciting a valid failure (e.g., a successful prompt injection). Defenders are rewarded for resisting the attack AND completing their original task (the second clause is critical — a defender cannot win by simply refusing everything, since it must still finish the task). As defenders harden, GPT-Red is forced to discover stronger and more diverse attacks. Trained at compute comparable to some of OpenAI's largest post-training runs — an unprecedented amount of compute dedicated purely to safety.

Each training environment carries a threat model — a specification of what GPT-Red controls and what counts as a successful attack. GPT-Red might control part of a local file, a webpage banner, an email body, or a tool's output. It discovered a novel attack class: Fake Chain-of-Thought — injecting a spoofed entry into the model's reasoning trace (a chain of thought is the running note an LLM keeps while solving a problem). The target then acts on spoofed information it thinks it verified. Fake CoT attacks achieved upwards of 95% success on GPT-5.1 but are below 10% on GPT-5.6 Sol after adversarial training. Similarly, the overall prompt injection failure rate on held-out environments dropped to 0.05% for GPT-5.6 Sol.

Results and case studies. Indirect prompt injection arena (replicated Dziemian et al. 2025, arXiv:2603.15714) vs GPT-5.1: GPT-Red 84% attack success vs 13% for human red-teamers. Vs GPT-5 (August 2025) — over 90% of attacks work; vs GPT-5.6 less than 23% (MIT Tech Review). Case 1: Vendy — an AI-powered vending machine (Andon Labs, similar to Project Vend) in OpenAI's office. GPT-Red iterated attacks in simulation, then transferred them to the production agent, achieving all three objectives: change the price of an expensive item to $0.50, add an item worth >$100 for $0.50, cancel another customer's order. Case 2: Codex CLI agent (GPT-5.4 mini) on 10 held-out data-exfiltration scenarios — GPT-Red more effective and more token-efficient than a prompted GPT-5.5 baseline.

Impact on OpenAI's production models. Over the past 6 months OpenAI has trained progressively stronger red-teaming models (precursors to GPT-Red) with increasing compute, using them in the training of each subsequent production model since GPT-5.3. Each successive GPT release becomes more robust. GPT-5.6 Sol: 6x fewer failures on the hardest direct prompt injection benchmark vs OpenAI's best previous production model (four months earlier). Several indirect prompt injection benchmarks are saturated (>97% accuracy). Crucially, OpenAI verifies that robustness gains do not come from over-refusal — general frontier capabilities and targeted over-refusal tasks remain unaffected. Limitations: multi-turn and image-based attacks still require humans. GPT-Red will not be released. A preprint was announced for the same week.