OpenAI developed GPT-Red, an automated red-teaming model trained at the compute scale of its largest post-training runs to find vulnerabilities before deployment. Unlike human red-teaming, which is time-intensive and limited in scale, GPT-Red uses self-play reinforcement learning against diverse defender LLMs across realistic scenarios, iteratively discovering stronger attacks as defenders improve.

GPT-Red breaks nearly all internal and production models up to GPT-5.5, achieving 84% attack success on novel indirect prompt injection scenarios versus 13% for human red-teamers. In real-world tests, it compromised a live vending-machine agent (Vendy) and a Codex CLI agent, extracting sensitive data more effectively and efficiently than baselines.

OpenAI directly incorporates GPT-Red into production model training. GPT-5.6 Sol, the latest model hardened this way, shows 6x fewer failures on the hardest direct prompt injection benchmark compared to the best model from four months prior. This automated approach has been used for each successive model since GPT-5.3, enabling safety to scale alongside capabilities.