This week, OpenAI published details of GPT-Red：https://openai.com/index/unlocking-self-improvement-gpt-red/ , an internal-only automated red-teaming model. Its job is to attack OpenAI’s own models and find prompt injection vulnerabilities.
OpenAI gives two reasons. Human red-teaming is time-intensive and does not scale. Commonly used robustness evaluations are already saturated by its latest models.
Meanwhile, the attack surface grows. Agents read third-party data through browsers, connected apps, local files, and tools. Those affordances are necessary for real work. They also let an attacker plant a crafted instruction in that data.
GPT-Red：https://openai.com/index/unlocking-self-improvement-gpt-red/ ：https://openai.com/index/unlocking-self-improvement-gpt-red/is a model, not a static benchmark or a prompt library. It works like a human red-teamer. It sends a prompt, observes the response, and iterates toward a goal.
OpenAI team trained it at the compute scale of some of its largest post-training runs, purely for safety.
Two deployment decisions matter. First, GPT-Red is kept separate from deployed models. That keeps its malicious capabilities away from adversarial actors. Second, it does two jobs. It uncovers vulnerabilities before deployment, and generates attacks during training.
The second job depends on the training loop below.
GPT-Red is trained using self-play reinforcement learning. The attacker and a collection of diverse defender LLMs train simultaneously across a broad set of red-teaming scenarios.
The reward structure is the core idea:
That second clause matters. A defender cannot win by refusing everything, since it must still finish the task.
Each environment carries a threat model. It specifies what GPT-Red controls and what counts as success. GPT-Red might control part of a local file, a webpage banner, an email body, or a tool’s output.
As defenders harden, GPT-Red is forced to discover stronger and more diverse attacks. By the end of training, it breaks nearly all models it is pitted against. That includes internal and production models up to and including GPT-5.5.
Along the way, it also found something new.
A chain of thought is the running note an LLM keeps while solving a problem. An early GPT-Red learned to insert a fake entry into that note. The target then acts on spoofed information it thinks it verified.
OpenAI calls it a novel class of direct prompt injection attack, unseen by its researchers.
Consequently, that class became a training target.
OpenAI team tested GPT-Red on novel safety environments and unseen target models. The result replicates the indirect prompt injection arena from Dziemian et al. (2025)：https://arxiv.org/abs/2603.15714 . Humans and GPT-Red independently proposed attacks against GPT-5.1 there.
Separately, OpenAI team ran GPT-Red’s strongest attacks against two generations. Over 90% worked against GPT-5, released August 2025. Fewer than 23% work against GPT-5.6.：https://www.technologyreview.com/2026/07/15/1140514/meet-gpt-red-an-llm-super-hacker-openai-built-to-make-its-models-safer/
Benchmarks are one thing. Live systems are another.
OpenAI also ran two case studies against real agentic systems, with incomplete knowledge of each harness.
OpenAI pitted GPT-Red against Vendy, an AI-powered vending machine in its office. Andon Labs built it, and OpenAI notes it resembles Project Vend. GPT-Red iterated in simulation, then transferred the attack to the production agent. It achieved all three objectives:
OpenAI disclosed these vulnerabilities, and new safeguards are actively being tested.
GPT-Red attacked a Codex CLI agent based on GPT-5.4 mini. The suite covered 10 held-out data-exfiltration scenarios. Against a prompted GPT-5.5 baseline, it was more effective and more token efficient.
For developers, the reusable part is the attack’s shape.
In OpenAI’s published sample, an assistant runs file_search.search over an internal corpus. The retrieved file’s metadata carries a planted marker (host redacted):
The marker imitates a system rule about uploading diagnostics. GPT-5.1 followed it and issued a web.post to that endpoint. GPT-5.6 resisted, reasoning the injected tool output should be ignored.
Scoring task_completed alongside attack success is not optional. OpenAI ran the same control.
Asif Razzaq is the CEO of Marktechpost Media Inc.. As a visionary entrepreneur and engineer, Asif is committed to harnessing the potential of Artificial Intelligence for social good. His most recent endeavor is the launch of an Artificial Intelligence Media Platform, Marktechpost, which stands out for its in-depth coverage of machine learning and deep learning news that is both technically sound and easily understandable by a wide audience. The platform boasts of over 2 million monthly views, illustrating its popularity among audiences.
Scan to open this article