OpenAI details GPT-Red, an automated red-teaming model

OpenAI has published details on GPT-Red, an internal-only automated red-teaming model designed to identify prompt injection vulnerabilities in its own systems. The system uses self-play reinforcement learning to attack and defend against diverse scenarios, addressing the scalability limits of human red-teaming.

• GPT-Red achieved an 84% success rate on indirect prompt injection scenarios against GPT-5.1, compared to 13% for human red-teamers.
• The model discovered a novel "Fake Chain-of-Thought" attack, achieving upwards of 95% success against GPT-5.1 but below 10% against GPT-5.6 Sol.
• In live case studies, GPT-Red successfully manipulated a vending machine agent to alter prices and cancel orders.
• Training defenders required them to resist attacks while still completing their original tasks, preventing refusal-based wins.

The findings highlight the growing attack surface for agentic systems and demonstrate how automated red-teaming can uncover vulnerabilities that human teams miss.