OpenAI has built an internal model called GPT-Red that’s designed to break other models, and they gave it an unprecedented amount of compute to do it. The core problem is straightforward: human red-teaming is slow, expensive, and can’t generate the sheer volume of adversarial data needed to harden frontier models. So the company turned to automation.
GPT-Red is trained via self-play reinforcement learning, where it continuously attacks a pool of defender LLMs. It gets rewarded for triggering a valid failure—like a successful prompt injection—while the defenders are rewarded for resisting and sticking to their task. As the defenders get tougher, GPT-Red is forced to invent more creative and potent attacks. The training environment simulates realistic injection points: a poisoned email body, a malicious webpage banner, a compromised local file, or tainted tool output.
The results are stark. The team pitted GPT-Red against a range of models and found it could break nearly all of them, including internal and production systems up to OpenAI’s own GPT-5.5. That offensive capability was then turned directly into a defensive one. During training of the newly announced GPT-5.6, the team fed in attacks generated by GPT-Red. The outcome? OpenAI claims GPT-5.6 Sol shows a sixfold reduction in failures on its hardest direct prompt injection benchmark, compared to the best production model from just four months ago.
OpenAI is keeping the attacker model itself private to prevent its weaponization, but the robustness it creates gets baked into public releases. The company frames this as a form of self-improvement for safety—using today’s models to directly make tomorrow’s models harder to compromise. They plan to scale the approach alongside traditional human red-teaming and third-party audits. It’s a significant shift: instead of patching vulnerabilities after they’re found in the wild, the goal is to find and fix them during training itself.
