GPT-Red: Unlocking Self-Improvement for Robustness
OpenAI Blog · 2026-07-15
OpenAI introduces GPT-Red, an automated red-teaming model trained via self-play reinforcement learning that achieves an 84% attack success rate on novel prompt injection scenarios versus 13% for human red-teamers, and was used to make GPT-5.6 Sol six times more robust to prompt injections.
Appears in
Extraction
Topics: ai-safetyautomated-red-teamingprompt-injectionmodel-robustnessllm-security
Claims
- GPT-Red, trained via self-play reinforcement learning against diverse defender LLMs, achieves an 84% attack success rate on novel red-teaming scenarios, compared to 13% for human red-teamers on the same scenarios.
- GPT-5.6 Sol trained against GPT-Red is six times more robust to prompt injections compared to OpenAI's best production model from four months prior.
- GPT-Red successfully attacked a real AI-powered vending machine in the OpenAI office, achieving all three malicious objectives including changing item prices and canceling a customer's order.
- GPT-5.6 Sol now fails on only 0.05% of GPT-Red's direct prompt injection attacks, with no measurable loss of general capabilities.
- OpenAI deliberately keeps GPT-Red separate from deployed production models to prevent its trained attack capabilities from being accessible to adversarial actors.
Key quotes
We believe with GPT‑Red that we have started to unlock a similar flywheel for safety, where today's models can be used to make tomorrow's models more robust, aligned, and trustworthy.
GPT‑Red achieves significantly higher attack success rates, finding success on 84% of scenarios compared to 13% for humans.
A model can appear safer by refusing more requests or becoming less capable. A model that does less is naturally harder to attack, but that is not useful robustness.