GPT-Red Explained: OpenAI's Self-Play Attacker and GPT-5.6's Stronger Defenses¶

For / Key Points

For: Engineers integrating AI agents into business systems or development workflows who need to plan for prompt-injection risk.

Key points:

GPT-Red is an internal attacker trained through self-play alongside a population of defender models.
It succeeded in 84% of unseen scenarios, while GPT-5.6 Sol failed on 0.05% of its direct injections.
Both figures come from OpenAI's internal evaluations, so model robustness remains only one layer of defense.

A few instructions hidden in a web page or email can make an AI agent send internal files to an attacker. OpenAI responded to this prompt-injection risk by building GPT-Red, an internal model that automatically generates attacks, and publicly described it on July 15, 2026.¹²This article asks how practitioners should interpret the headline figures: 84% attack success and 0.05% defender failure.

What GPT-Red changes¶

GPT-Red automates the iterative work normally performed by human red teams. It sends an attack, observes the target model, and refines its strategy until it succeeds. OpenAI says it trained GPT-Red with compute comparable to some of its largest post-training runs, dedicated solely to improving safety.¹

Human testing remains valuable, but it cannot produce adversarial examples at the volume and diversity needed for training. Some widely used robustness evaluations have also been saturated by newer models. GPT-Red puts vulnerability discovery and training-data generation into the same continuous loop.

Self-play trains attacker and defenders together¶

The core method is self-play reinforcement learning between GPT-Red and a diverse population of defender LLMs. GPT-Red receives a reward for eliciting a valid failure. A defender earns a reward only when it resists the attack and still completes the original task, which discourages the degenerate strategy of refusing everything.¹

Each environment defines a threat model: what GPT-Red controls and what counts as success. Controllable surfaces include parts of local files, web banners, email bodies, and tool output. By the end of training, GPT-Red could break nearly every internal and production model through GPT-5.5; OpenAI keeps the attacker private and transfers only the robustness gains into deployed models.¹

The 84% figure is scenario coverage¶

The 84% figure does not mean that any arbitrary GPT-Red attack succeeds 84% of the time. OpenAI replicated the indirect prompt-injection arena from Dziemian et al. and attacked GPT-5.1 in scenarios excluded from GPT-Red's training. GPT-Red found at least one successful attack in 84% of scenarios, compared with 13% for human red teamers.¹³

In the vending-machine test, GPT-Red reduced an expensive product to the $0.50 floor, ordered a $100-plus item and offered it for $0.50, and canceled another customer's order.¹ The setup resembled Anthropic and Andon Labs' Project Vend.⁴ In a separate suite of ten tasks, GPT-Red beat a prompted GPT-5.5 baseline against a GPT-5.4 mini Codex CLI agent while using fewer tokens.¹

What GPT-5.6 Sol's 0.05% shows¶

OpenAI has progressively used GPT-Red's precursors to train every production model since GPT-5.3. It reports the following results for GPT-5.6 Sol.¹

Evaluation	Comparison	GPT-5.6 Sol result
Hardest direct-injection benchmark	Best production model four months earlier	Six times fewer failures
Fake Chain-of-Thought attack	Above 95% success on GPT-5.1	Below 10%
GPT-Red direct injections	Nearly all pre-5.6 models broken	0.05% failure rate
Internal indirect-injection benchmarks	Developer tools and browsing	Above 97% accuracy

Fake Chain-of-Thought inserts a fabricated reasoning record so the target treats false information as something it already verified.¹⁵ The 0.05% number, however, is the average success rate across GPT-Red's attempts in held-out environments. It is neither a field incident rate nor a guarantee against every unknown attacker.

OpenAI says it evaluated general capability and targeted over-refusal, finding no loss of normal capability.¹ That is a sensible way to reject the appearance of safety created by refusing all work, but OpenAI remains the evaluator of its own claim.

Treat model robustness as one layer¶

At publication time, OpenAI had not released the detailed GPT-Red preprint, preventing third parties from checking reproduction conditions and statistical uncertainty. MIT Technology Review also reported that GPT-Red remains weak at multi-turn attacks and attacks involving images. CSET senior research analyst Jessica Ji called self-play promising while emphasizing the continuing importance of human expertise.⁵

The most prominent defender figures—0.05% and below 10% for Fake Chain-of-Thought—concern direct injection. The above-97% indirect result can indicate benchmark saturation rather than a solved threat. Defenders were also trained on GPT-Red's attack distribution, so equally strong generalization to unknown distributions should not be assumed.

Operational defenses therefore remain necessary.²

Minimize agent access to files, credentials, and external services.
Require human confirmation before sending, purchasing, deleting, or other irreversible actions.
Restrict egress so an environment holding sensitive data cannot transmit it anywhere.
Combine model resistance with monitoring, sandboxing, and audit logs.

Summary: safety self-improvement has only started¶

GPT-Red's important contribution is not one new attack technique but a persistent attack-discovery loop inside model training. OpenAI is now using today's models to generate attacks that harden tomorrow's models.

The next question is bigger than whether 0.05% can become smaller. Can new evaluations and independent verification advance faster than internal benchmarks saturate? The answer will determine whether stronger model defenses translate into safer real-world agents.

OpenAI, GPT-Red: Unlocking Self-Improvement for Robustness, July 15, 2026. ↩↩↩↩↩↩↩↩↩↩
OpenAI, Understanding prompt injections: a frontier security challenge, November 7, 2025. ↩↩
Dziemian et al., How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition, March 16, 2026. ↩
Anthropic, Project Vend: Can Claude run a small shop? (And why does that matter?), June 27, 2025. ↩
MIT Technology Review, Meet GPT-Red: an LLM super-hacker OpenAI built to make its models safer, July 15, 2026. ↩↩