OpenAI: GPT-Red Cuts GPT-5.6 Prompt Injections 6x
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- OpenAI disclosed GPT-Red, an internal red-teaming model that sends prompts, observes responses, and iterates toward malicious goals — the same loop a human attacker would run, automated at scale.
- GPT-Red is trained via self-play reinforcement learning against a collection of defender LLMs, with the attacker rewarded for eliciting prompt injection failures and defenders rewarded for completing their original tasks under attack.
- GPT-5.6 Sol achieves 6x fewer failures on OpenAI's direct prompt injection benchmark compared to GPT-5.5, and GPT-Red's attack success rate on the latest model has dropped to just 0.05%.
- GPT-Red generates successful indirect prompt injection attacks against GPT-5.1 in more scenarios than human red-teamers, and an early version uncovered a novel "Fake Chain-of-Thought" attack class that posted >95% success on GPT-5.1 but now falls below 10% on GPT-5.6 Sol.
- In a real-world test, GPT-Red compromised an AI-based vending machine built by Andon Labs, meeting all three goals: dropping an item's price to the $0.50 minimum, ordering a $100 item for that same amount, and canceling another customer's order.
- GPT-Red also attacked a Codex command-line agent (GPT-5.4 mini) across 10 held-out data-exfiltration tasks, causing more sensitive data transmission than a prompted GPT-5.5 baseline.
- OpenAI is keeping GPT-Red architecturally separate from its production models so the attack capabilities it develops do not leak to adversaries probing the company's own safeguards.
Why it matters: OpenAI is documenting that automated adversarial training now outpaces human red-teamers on indirect prompt injections (the attack class most relevant to agentic systems hooked into browsers, email, and code repos). The 0.05% failure floor on direct injections and the full compromise of a live agentic system — the Andon Labs vending machine — show that every shipping model must now be hardened against an AI adversary that improves on the same release cycle, compressing the time defenders have to patch between model launch and attack deployment.
