On July 15, 2026, OpenAI published a safety research announcement detailing GPT-Red, an internal automated red-teaming model trained to find vulnerabilities — especially prompt injections — so production models can be hardened before wider deployment.
Problem framing: Human red-teaming does not scale; common robustness evaluations are saturated by latest models; agents that browse, use tools, and read third-party content create more injection surfaces (emails, webpages, tool outputs, repos).
What GPT-Red is: An attacker model that iterates like a human red-teamer — send a prompt, observe the defender response, refine. Trained at the compute scale of some of OpenAI’s largest post-training runs, dedicated purely to safety. Kept internal and separate from deployed models so attack capabilities are not released.
Training: Self-play reinforcement learning against diverse defender LLMs across realistic environments (local files, webpage banners, email bodies, tool outputs). GPT-Red is rewarded for valid failures (e.g., successful prompt injection); defenders are rewarded for resisting and completing tasks.
Results claimed:
- Against GPT-5.1 on a replicated indirect prompt injection arena (Dziemian et al., 2025), GPT-Red succeeded on 84% of scenarios vs 13% for human red-teamers.
- Used adversarially in training GPT-5.6; GPT-5.6 Sol is described as the most robust OpenAI model to prompt injections to date — 6x fewer failures on hardest direct prompt injection benchmark vs best production model from four months earlier.
- “Fake Chain-of-Thought” attacks: >95% success on GPT-5.1, below 10% on GPT-5.6 Sol.
- Broad robustness environments: GPT-5.6 Sol fails on only 0.05% of GPT-Red’s direct prompt injections.
- Real-world case studies: broke a production vending-machine agent (Vendy / Andon Labs) — price manipulation, cheap ordering, canceling another customer’s order; outperformed prompted GPT-5.5 baseline on Codex CLI data-exfiltration scenarios.
OpenAI says capabilities remain unaffected while robustness improved (not via blanket refusal). Precursor red-teamers have been used since GPT-5.3. A pre-print with more details was promised later in the week. GPT-Red will not be released as a product.