GPT-Red: Unlocking Self-Improvement for Robustness

2026-07-09 · Source: OpenAI News · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Advanced, medium

Summary

OpenAI has developed GPT-Red, an automated red-teaming model designed to identify and fix vulnerabilities in large language models, particularly prompt injection attacks. This model was trained using self-play reinforcement learning at a compute scale comparable to OpenAI's largest post-training runs. GPT-Red proved highly effective, achieving an 84% attack success rate on novel scenarios against GPT-5.1, significantly outperforming human red-teamers at 13%. By incorporating GPT-Red into the training process, OpenAI's GPT-5.6 Sol model achieved 6x fewer failures on its hardest direct prompt injection benchmark compared to previous models, and reduced "Fake Chain-of-Thought" attack success rates from 95% on GPT-5.1 to below 10% for GPT-5.6 Sol. The model also demonstrated real-world attack capabilities against an AI-powered vending machine and a Codex CLI agent, while maintaining general frontier capabilities without over-refusal.

Key takeaway

For AI Security Engineers focused on LLM robustness, this research indicates that automated red-teaming is crucial for scaling defenses against prompt injection. You should integrate self-play adversarial training into your model development lifecycle to proactively identify and mitigate vulnerabilities. This approach allows your models to become significantly more resilient, as demonstrated by GPT-5.6 Sol's 6x improvement, without compromising core capabilities. Consider deploying internal-only red-teaming agents to continuously harden your production systems.

Key insights

Automated self-play red-teaming with GPT-Red significantly enhances LLM robustness against prompt injection attacks.

Principles

• Automated red-teaming scales vulnerability discovery.
• Self-play reinforcement learning drives attack diversity.
• Robustness training should not degrade capabilities.

Method

GPT-Red is trained via self-play reinforcement learning, where it attacks diverse defender LLMs in realistic scenarios, rewarded for eliciting failures, while defenders resist.

In practice

• Use automated red-teamers to generate adversarial training data.
• Implement self-play to evolve attack and defense strategies.
• Evaluate robustness on novel, real-world agentic systems.

Topics

• Automated Red Teaming
• Prompt Injection
• LLM Robustness
• Self-Play Training
• AI Safety
• Adversarial Training

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• Meet GPT-Red: an LLM super-hacker OpenAI built to make its models safer — OpenAI's GPT-Red, an LLM super-hacker, automates red-teaming through self-play to significantly improve LLM defenses against novel cyberattacks like prompt injection.
• AI Red Teams for Adversarial Training: How to Make ChatGPT and LLMs Adversarially Robust — AI Red Teams are crucial for identifying and mitigating adversarial vulnerabilities in large language models.
• PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections — PI-Hunter proactively exposes latent prompt injections in LLM agents via feedback-driven, evolutionary red-teaming.
• LLM agent safety, multi-turn red-teaming, jailbreak benchmarks, adversarial robustness, safety-critical systems — LLM agents in safety-critical systems exhibit disjoint vulnerabilities and model-dependent defense efficacy under multi-turn adversarial attacks.
• Learning to Attack and Defend: Adaptive Red Teaming of Language Models via GRPO — AdvGRPO enables stable GRPO-based co-training for adaptive LLM red teaming, yielding effective attacks and robust defenders.
• OpenAI is now using AI to attack its own AI, and it's working better than humans ever did — OpenAI's GPT-Red, an AI red teamer, significantly outperforms humans in finding prompt injection vulnerabilities through self-play reinforcement learning.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by OpenAI News.