OpenAI's GPT-Red Beats Human Hackers 84% to 13% on Prompt Injection

As AI agents gain the ability to browse the web, read emails, execute code, and call external APIs, one attack class has quietly become the defining security threat of the agentic era: prompt injection. An attacker embeds a malicious instruction inside content the agent reads , a webpage, a document, a tool response , and the agent follows it as if it came from the user. Documented injection attempts against enterprise AI rose about 340% year over year in late 2025, and indirect attacks , instructions hidden in an email, document, or web page , are now the dominant vector. OpenAI's answer to this is GPT-Red, a new internal automated red-teaming model that finds these vulnerabilities at scale and feeds them directly into production model training.

The bottleneck GPT-Red is built to break

Red-teaming , having skilled humans try to break a model before it ships , is how the industry discovers vulnerabilities. But it doesn't scale. Human red-teaming is time-intensive, limiting how quickly new failure modes can be identified and incorporated into stronger safeguards. And while these exercises produce valuable examples of successful attacks, they cannot generate the volume and diversity of adversarial data needed to improve model robustness through training.

The problem is compounding. Keeping pace with increasingly capable models requires red-teaming to scale as well. At the same time, prompt injection is still the number one entry on the OWASP LLM Top 10 in 2026, and security researchers now treat it as an unsolved problem rather than a bug awaiting a patch. The gap between how fast models are improving and how fast safety testing can keep up is exactly what GPT-Red is designed to close.

Self-play: the same trick that made AlphaGo, applied to safety

Self-play reinforcement learning , where a model trains by competing against itself or copies of itself , is the same technique that produced superhuman game-playing agents. In self-play RL, agents optimize policies by interacting and competing with instances of themselves within adversarial environments. In contrast to fixed-opponent training, self-play generates inherently adaptive curricula, allowing agents to reach strategic depth and robustness unattainable by conventional supervised or single-agent RL. GPT-Red applies this directly to safety.

GPT-Red is trained using self-play reinforcement learning, where the model and a collection of diverse defender LLMs are trained simultaneously on a broad set of red-teaming scenarios. GPT-Red is rewarded for eliciting a valid failure, such as a successful prompt injection, while the defender models are rewarded for resisting the attack and completing their original tasks. As defenders get better, GPT-Red is forced to find more creative attacks. As GPT-Red gets stronger, defenders are pushed to become more robust. The loop never stalls.

To make this training realistic, OpenAI built an expansive set of realistic scenarios where prompt injections might be inserted. Each environment has a threat model that specifies what GPT-Red can control and what counts as a successful attack , for instance, GPT-Red might control part of a local file, a webpage banner, an email body, or the output of a tool.

One important detail: GPT-Red is kept separate from the models OpenAI deploys. This keeps the malicious capabilities specifically trained into GPT-Red out of the hands of adversarial actors, while instilling robustness into production models. GPT-Red is purely internal.

How strong is it, really?

At the end of its training, GPT-Red can break nearly all models it is pitted against, both internal and production models up to and including GPT-5.5. On a standardized benchmark, the numbers are stark: GPT-Red achieves significantly higher attack success rates than human red-teamers, finding success on 84% of scenarios compared to 13% for humans on the indirect prompt injection arena from Dziemian et al. (2025).

OpenAI also tested GPT-Red against real-world agentic systems. GPT-Red was pitted against an AI-powered vending machine in the OpenAI office. After iterating on attacks in simulation and then transferring them to the production agent, GPT-Red achieved all three of its malicious objectives: changing the price of an expensive in-stock item to $0.50, ordering a new $100+ item and offering it for $0.50, and canceling another customer's order.

Against a Codex CLI agent backed by GPT-5.4 Mini, GPT-Red was both more effective at getting the agent to exfiltrate sensitive data across more scenarios, and more token-efficient than a prompted GPT-5.5 baseline.

What GPT-Red found , and fixed

An early version of GPT-Red found a novel class of direct prompt injection attacks known as "Fake Chain-of-Thought" attacks , where the injected content mimics the model's internal reasoning to hijack its behavior. These attacks achieved success rates of upwards of 95% on GPT-5.1 but are now below 10% for GPT-5.6 Sol.

The headline result is the improvement in GPT-5.6 Sol:

• GPT-5.6 Sol fails on only 0.05% of GPT-Red's direct prompt injections.
• GPT-5.6 Sol achieves 6x fewer failures on the hardest direct prompt injection benchmark compared to the best production model from just four months earlier.
• Several indirect prompt injection benchmarks targeting attacks in developer tools and browsing have been saturated by the latest model, with accuracy above 97%.

Critically, this robustness didn't come at the cost of capability. OpenAI evaluated both general frontier capabilities and targeted over-refusal tasks, finding that all normal capabilities remain unaffected while robustness improved significantly , suggesting the gains came from better resistance to malicious instructions rather than refusing legitimate requests by default.

The flywheel for safety

The deeper significance here is architectural. AI labs have already built capability flywheels: use today's model to generate training data that makes tomorrow's model more capable. GPT-Red is OpenAI's attempt to build the same kind of compounding loop for safety. OpenAI has trained progressively stronger red-teaming models with increasing compute over the last six months, using these models in the training of each successive production model since GPT-5.3, with each subsequent GPT release becoming more robust.

The compute investment signals how seriously OpenAI is treating this. GPT-Red was trained at the compute scale of some of OpenAI's largest post-training runs , an unprecedented amount of compute dedicated purely to improving safety.

This matters because the alternative , relying purely on human red-teamers and static benchmarks , is already failing. Commonly used robustness evaluations have already been saturated by OpenAI's latest models, meaning the field needs harder, continuously evolving tests. GPT-Red generates those automatically.

What this means for the field

The industry context makes this release particularly timely. One technique ties most recent agentic security incidents together: prompt injection. OWASP maps it to six of the ten categories in its Top 10 for Agentic Applications. As organizations race to deploy AI agents with real-world capabilities , accessing databases, executing code, sending emails, and managing financial transactions , the attack surface has expanded from tricking a chatbot into saying something embarrassing to tricking an autonomous agent into transferring funds to the wrong account.

GPT-Red's approach challenges a core assumption that has dominated AI safety work: that safety improvements require human judgment at every step. The model demonstrates that an AI system can be trained to discover novel attack classes that humans miss, at a scale and speed that human red-teamers cannot match. Conventional safety alignment relies on a reactive, disjoint procedure: attackers exploit a static model, followed by defensive fine-tuning to patch exposed vulnerabilities. This sequential approach creates a mismatch , attackers overfit to obsolete defenses, while defenders perpetually lag behind emerging threats. Self-play breaks that cycle.

GPT-Red is internal-only and not something you can run against your own systems. But its outputs are baked into GPT-5.6 Sol, which is available today. If you're building agentic systems on top of OpenAI's models , anything that reads external content and takes actions , you're already benefiting from what GPT-Red found. OpenAI says a preprint with more technical details is coming soon.