- GPT-Red achieved an 84% attack success rate on indirect prompt injection scenarios, compared to 13% for human red teamers on identical tests [1] - GPT-5.6 Sol shows 6x fewer failures on direct prompt injection benchmarks versus the best model from four months prior, and fails on only 0.05% of GPT-Red's direct injections
[[2]](https://thehackernews.com/2026/07/openais-gpt-red-automates-prompt.html) - Fake chain-of-thought attack effectiveness dropped from above 95% on GPT-5.1 to below 10% on GPT-5.6 Sol
[[2]](https://thehackernews.com/2026/07/openais-gpt-red-automates-prompt.html) - OpenAI committed over 700,000 GPU hours to automated red teaming and will keep GPT-Red as an internal-only tool
[[3]](https://decrypt.co/373613/openai-ai-red-team-strengthen-gpt-5-6-prompt-injection-attacks) - GPT-Red remains a complement to human red teamers and third-party testing, not a replacement
[[1]](https://openai.com/index/unlocking-self-improvement-gpt-red)
OpenAI on July 16 disclosed GPT-Red, an internal automated red-teaming system that uses adversarial self-play reinforcement learning to probe its own AI models for prompt injection vulnerabilities. In tests on novel safety environments, GPT-Red achieved an 84% attack success rate, dwarfing the 13% rate achieved by human red teamers on identical scenarios [1].
The system's findings have been fed directly into the training pipeline for GPT-5.6 Sol, OpenAI's latest flagship model released on July 9. The result: a 6x reduction in direct prompt injection failures compared to the company's best model from four months earlier, and a failure rate of just 0.05% against GPT-Red's own direct prompt injections [2].
GPT-Red works by generating progressively stronger attacks while defender models simultaneously learn to resist them — a technique the company calls adversarial self-play. OpenAI committed more than 700,000 GPU hours to the effort, underscoring the computational scale required to automate safety testing for frontier AI systems [3].
How GPT-Red Works #
GPT-Red operates much like a human security researcher: it sends a prompt, monitors how a target model responds, and iterates toward a specific malicious objective such as data exfiltration or unauthorized action execution. The critical difference is scale. Where human red teamers test a handful of attack vectors manually, GPT-Red runs thousands of scenarios simultaneously through self-play reinforcement learning [1].
In the training loop, GPT-Red earns rewards for successful attacks while a set of diverse defender LLMs earn rewards for resisting those attacks without degrading their performance on legitimate tasks. Both sides train concurrently, creating an escalating arms race that surfaces vulnerabilities faster than static testing [2].
OpenAI stated that GPT-Red 'learns through adversarial self-play, where its goal is to prompt inject' target models across a wide range of scenarios, including internal directory exfiltration, fraudulent payment instructions, AWS credential theft, two-factor authentication disabling, and API key forwarding [1].
GPT-5.6 Sol: The Hardened Model #
The practical payoff of GPT-Red is visible in GPT-5.6 Sol's benchmark results. On direct prompt injection tests, GPT-5.6 Sol achieves 6x fewer failures than the previous leading model. On indirect prompt injection benchmarks involving developer tools and web browsing, the model reaches over 97% accuracy [2].
One of the most striking improvements is against so-called 'fake chain-of-thought' attacks, where an adversary embeds misleading reasoning in a prompt to manipulate model behavior. On GPT-5.1, these attacks succeeded more than 95% of the time. On GPT-5.6 Sol, effectiveness dropped to below 10% [2].
Crucially, OpenAI reported that capability metrics remained stable — frontier performance scores and over-refusal rates showed no degradation, meaning the safety hardening did not come at the cost of model usefulness [3].
Real-World Attack Demonstrations #
In one case study, GPT-Red successfully manipulated an AI-powered autonomous vending machine agent into lowering its prices, ordering discounted inventory, and canceling another customer's order — all before any disclosure of the attack [1].
Testing against a GPT-5.4 mini Codex command-line agent, GPT-Red achieved data exfiltration in more scenarios than baseline attack models, demonstrating that agentic AI systems with real-world tool access present an expanding attack surface [2].
The range of tested attack vectors — from credential theft to malicious scraper script injection — reflects the growing complexity of prompt injection risks as AI models gain deeper integration with enterprise systems and autonomous workflows [2].
Containment and Future Plans #
OpenAI emphasized that GPT-Red will remain an internal-only tool. Because the system contains intentionally developed offensive capabilities, the company maintains strict separation between GPT-Red and production systems to prevent those capabilities from reaching external actors [1].
The company positioned GPT-Red as a complement to — not a replacement for — human red teamers, third-party testing, and other safety measures. The 84%-versus-13% gap highlights the limitations of human-only approaches at frontier model scale, but OpenAI acknowledged that human judgment remains essential for evaluating novel risk categories [1].
Looking ahead, OpenAI said it plans to 'continue to scale compute and data while making algorithmic improvements, to train future versions of GPT-Red that are stronger than today's model. And in turn, these models will help make future GPT releases safer' [3].
Companies mentioned #
Further sources #
The stories that matter, in one email. Free — unsubscribe anytime.