OpenAI Details GPT-Red Automated Model for AI Safety Testing

OpenAI announced GPT-Red on July 15, 2026, an internal automated red-teaming model built to identify security vulnerabilities and train AI systems against prompt injection attacks. Developed using self-play reinforcement learning at the compute scale of OpenAI’s largest post-training runs, the system reduced model failure rates on the company’s latest model, GPT-5.6 Sol, to 0.05 percent during direct prompt injection testing.

GPT-Red operates by iteratively generating adversarial inputs, evaluating how target AI models respond, and refining its attack strategies. By running autonomously, the system uncovers failure modes and security weaknesses in candidate models before they are released to the public.

Automated Self-Play Training Mechanics

OpenAI trained GPT-Red using self-play reinforcement learning, pairing the attacker model against a diverse collection of defender language models across various safety scenarios. During training, GPT-Red received rewards when it successfully triggered model failures, such as bypassing system instructions through direct or indirect prompt injections. Conversely, defender models received rewards for resisting those attacks while successfully completing their assigned user tasks.

As defender models became more resilient, GPT-Red was forced to discover more complex attack strategies to earn rewards. The training environments established threat models that granted GPT-Red control over specific data inputs, including:

• Local file content and system directories
• Webpage banners and external browser data
• Email text bodies and message attachments
• Outputs generated by connected software tools

The company committed substantial computational resources to the initiative, consuming compute equivalent to its largest internal post-training runs and using over 700,000 GPU hours.

Performance Benchmarks Against Human Attackers

To evaluate how well the model generalizes beyond its initial training setups, OpenAI tested GPT-Red against target models in novel safety environments. In a benchmark replicating an indirect prompt injection arena targeting GPT-5.1, both human security researchers and GPT-Red independently attempted to compromise the model across identical scenarios.

GPT-Red recorded an 84 percent attack success rate on the test suite. In comparison, human security teamers achieved a 13 percent success rate on the same set of environments.

OpenAI also tested GPT-Red against a developer command-line interface tool powered by GPT-5.4 mini across 10 data-exfiltration scenarios. When compared with a prompted GPT-5.5 baseline model, GPT-Red succeeded across more scenario types while requiring lower test-time compute to execute its attacks.

End-to-End Agent Exploitation: The Vendy Vending Machine Test

OpenAI tested GPT-Red in end-to-end environments against real-world agentic systems capable of taking external actions through tools. In one experiment, researchers pitted the model against “Vendy,” an AI-managed office vending machine developed by Andon Labs.

The testing process followed a structured sequence:

1. GPT-Red received system documentation and analyzed simulated tool calls in a sandboxed mirror environment.
2. The model developed and refined attack sequences within the simulation.
3. The model transferred verified attack payloads to target the live production vending agent.

During testing against the live agent, GPT-Red achieved all three of its assigned malicious goals:

• Changed the price of an expensive in-stock item to the minimum price of $0.50
• Ordered a new item valued above $100 and listed it for sale at $0.50
• Canceled an active order belonging to another customer

OpenAI disclosed the discovered vulnerabilities to Andon Labs, and updated safety safeguards are undergoing testing.

Defenses and Impact on Production Models

OpenAI has incorporated outputs from GPT-Red and its earlier prototype versions into the training pipelines of its production models since GPT-5.3. By feeding synthetic attack data back into post-training pipelines, the company hardens newer models against prompt manipulation before public deployment.

In testing on GPT-5.6 Sol, OpenAI reported a sixfold reduction in model failures on its hardest direct prompt injection benchmark compared to its primary production model from four months earlier. Direct prompt injection attempts generated by GPT-Red succeeded against GPT-5.6 Sol in only 0.05 percent of cases, representing a 99.95 percent defense success rate.

Specific vulnerability classes showed marked declines in exploitation rates:

• Fake Chain-of-Thought attacks dropped from an over 95 percent attack success rate on GPT-5.1 to under 10 percent on GPT-5.6 Sol.
• Indirect prompt injection benchmarks covering web browsing and developer tools reached over 97 percent task accuracy on GPT-5.6 Sol.

These safety improvements were achieved without degrading general model performance or triggering unnecessary default refusals during standard tasks.

Deployment Limits and System Isolation

OpenAI maintains GPT-Red strictly as an internal-only model. The company does not deploy GPT-Red to external users or integrate its attacker capabilities into public API endpoints.

This structural isolation prevents adversarial actors from accessing specialized attack generation tools while enabling OpenAI to harness the generated synthetic data to train production safeguards.