OpenAI has published GPT-Red, an internal automated red-teaming model built to find prompt-injection failures at scale.
The July 15 publication describes GPT-Red as a system trained through adversarial self-play. It attempts to prompt-inject defender models, then successful attacks are used to improve those defenders. As the defenders improve, GPT-Red has to search for broader and more complex failures.
OpenAI says GPT-Red is internal, not a product launch for public use. That boundary matters because the same capability that helps a lab harden models can also produce stronger attack attempts if released without controls.
The benchmark claim is about red-team scale
OpenAI says GPT-Red outperformed human red-teamers in a replicated indirect prompt-injection arena based on Dziemian et al. (2025). In that test, both humans and GPT-Red proposed attacks against GPT-5.1 across environments that were distinct from GPT-Red’s training scenarios.
The result OpenAI reports is stark: GPT-Red found successful attacks in 84% of scenarios, compared with 13% for human red-teamers.
That does not mean GPT-Red proves safety. It means the bottleneck shifts. If an automated red teamer can find more failures faster, labs can produce more adversarial training data, but they also need better ways to decide which failures matter, which fixes generalize, and which systems are ready for deployment.
The defender claim is about GPT-5.6
OpenAI also ties GPT-Red to GPT-5.6 robustness. The company says training against GPT-Red’s attacks made GPT-5.6 substantially more resilient, including a sixfold robustness improvement on its hardest direct prompt-injection benchmark.
The important phrase is “OpenAI says.” These are internal measurements, not an external safety certification. They are still useful because they show how the lab is treating prompt injection: not as a static checklist, but as a moving adversarial training loop.
That is consistent with where agent products are going. A model that reads email, browses files, calls tools, or changes settings is exposed to instructions written by other people. Prompt injection is no longer just a chat nuisance. It is a permissions and control problem.
