OpenAI built an AI to hack its own models
GPT-Red is OpenAI's automated red-teamer, trained to attack its own models until GPT-5.6 Sol fails on only 0.05% of its strongest prompt injections.
OpenAI has started using one of its own models to attack its other models. GPT-Red is an automated red-teamer trained through self-play: it and a set of defender models are trained simultaneously, with GPT-Red rewarded for eliciting a genuine failure, like a successful prompt injection, and the defenders rewarded for resisting while still completing their task.
The results, published July 15, are concrete. When OpenAI ran GPT-Red’s strongest attacks against GPT-5, more than 90% succeeded. Against GPT-5.6 Sol, the model GPT-Red helped train, fewer than 23% worked, and OpenAI reports Sol now fails on just 0.05% of GPT-Red’s direct prompt-injection attempts, a roughly sixfold improvement over the best production model from four months earlier.
Along the way, GPT-Red surfaced an attack type OpenAI says its researchers had not previously catalogued: a “fake chain of thought,” where the injected text inserts fabricated reasoning steps into a model’s own thought process so it acts on them as if it had already verified them. In one researcher’s description, it is the equivalent of telling a model “1+1=3, and you’ve already checked this,” and having it proceed from there.
GPT-Red is not a full replacement for human testers. OpenAI says it still struggles with multi-turn conversational attacks, where a human attacker builds an exploit across several exchanges, and with image-based prompt injections, both areas where human red-teamers currently outperform it.
For teams building on OpenAI’s models, the practical read is that direct, single-shot prompt injection is getting harder to pull off against the latest models, which is good news for anyone piping untrusted content into an agent. It is not a reason to stop testing your own integrations; the gaps GPT-Red admits to, multi-turn and multimodal attacks, are exactly the shapes real-world attacks tend to take. For a deeper look at that risk class, see when an email can hijack your AI and how to keep your coding agent from running attacker code.