OpenAI trained an internal model, GPT-Red, whose only job is attacking GPT models to expose their flaws. It lands a successful attack in 84% of test scenarios, against 13% for human red teamers. The direct payoff: GPT-5.6 Sol shows six times fewer failures on direct prompt injections than the best model from four months ago.
Key Takeaways
- GPT-Red simulates prompt injections and attacks hidden in emails, websites or files
- Trained through self-play: the attacker and defender models improve together at each iteration
- 3.8% of “stronger” injections still get through, and the model stays internal pending a detailed paper
Have an AI Sum Up This Article
ChatGPTA Homegrown Attacker That Crushes Human Red Teamers
Red teaming means deliberately attacking a system to expose its flaws before real adversaries do. OpenAI just industrialized the exercise: GPT-Red, an internal model trained for nothing else, finds a working attack in 84% of test scenarios. Human teams top out at 13% on the same scenarios.
The method rests on self-play reinforcement learning: GPT-Red attacks, defender models block, and each side learns from the other’s failures. The loop runs continuously, without fatigue and without assumptions about what an attack should look like.
The gap with human teams comes down to that absence of assumptions. An expert tests the vectors they know and the ones the literature documents. A self-play attacker also explores absurd phrasings, improbable detours, combinations no professional would spend time trying. The most expensive flaws sleep in that zone.
The playing field is the one every security team worries about: prompt injections, malicious instructions hidden in emails, web pages or files that an AI agent reads while working. OpenAI had already answered on the product side with the Lockdown Mode rolled out against prompt injection. GPT-Red goes after the problem at the root, inside training.
The Office Vending Machine as Proof of Concept
The most telling example comes from OpenAI’s own office. In one test, GPT-Red manipulated the AI-powered vending machine on site: prices changed, other customers’ orders canceled. A miniature demonstration of what a successful injection does to an agent wired into the real world.
The anecdote beats any benchmark. A vending machine is an agent with a catalog, prices and orders, which is exactly the structure of a customer service bot, a billing tool or a logistics back office. What works on snacks works on everything sharing that architecture.
The progress numbers set the scale of the gain. GPT-5.6 Sol shows six times fewer failures on direct injections than the best model from four months ago, without hurting general performance. Security stops being a trade against capability.
That last point reverses a historical compromise. Hardening a model against manipulation usually made it more skittish and less useful day to day. Getting the robustness gain without that tax changes the economics of deploying agents at all.
The attribution matters too: these are OpenAI’s own numbers, measured on OpenAI’s own scenarios, ahead of the promised paper. Useful as a trendline, not yet as an independent audit.
Then comes the number that keeps security leads awake: 3.8% of “stronger” injections still succeed. At the scale of thousands of automated attempts, that percentage leaves a very real volume of successful breaches. OpenAI concedes the point and is preparing a detailed paper, while GPT-Red stays strictly internal.
More articles on Horizon
- GPT-5.6 Sol Disproves a 30-Year Statistics Conjecture
- Claude Pro Goes Free for K-12 Teachers in the US
- DeepSeek Raises $1.5B and Plans an IPO at $71B
A Defensive Race Rivals Will Have to Join
For companies wiring agents into their email and documents, the message cuts both ways. Robustness is improving fast, yet no vendor promises immunity: the residual 3.8% still demands application-level guardrails, minimal permissions and audit logs.
Security leads also gain a planning signal. If the six-fold improvement pace holds across model generations, injection resistance becomes a criterion you can actually compare between vendors, quarter after quarter, instead of a marketing line nobody can audit.
For OpenAI, GPT-Red completes a defensive lineup taking shape as a product range. The company had already launched Daybreak, its AI cyberdefense platform, and put its models to work on vulnerability hunting when Codex started patching open source bugs. Automated attack becomes the third brick in that stack.
On the competitive side, the methodology gap will show. A lab still red teaming by hand covers hundreds of scenarios where self-play covers millions. Anthropic and Google will need to demonstrate equivalent setups, public numbers included, or watch OpenAI turn security into a measurable sales argument.
The announced paper will tell whether the method generalizes beyond OpenAI’s walls. A publicly documented GPT-Red would hand researchers a reproducible attack template, and real attackers a roadmap. The balance between transparency and caution is the real decision to watch.
Follow the story on Horizon.
