Overview
openai internal automated safety red-teaming model trained via adversarial self-play to discover prompt-injection and agent exploits. Not publicly released. Used to adversarially train gpt-56 Sol.
Recent Developments
- 2026-07-15: Public disclosure of method and results (2026-07-16-openai-gpt-red-official-primary)
- Claimed 84% vs 13% human success on held-out indirect prompt injection arena
- GPT-5.6 Sol: 6x fewer failures on hardest direct PI benchmark; 0.05% fail rate vs GPT-Red direct injections (vendor-reported)
- Discovered “Fake Chain-of-Thought” attack class; success dropped from >95% (GPT-5.1) to <10% (GPT-5.6 Sol)
- Broke live Andon Labs vending agent (Vendy) in case study; disclosed to fix
- Precursors used in training since GPT-5.3; pre-print promised later the same week
- Limits: multi-turn conversational and image-based injections still need humans (2026-07-16-openai-gpt-red-siliconangle)
Metrics are OpenAI self-reported pending pre-print.