Breaking

OpenAI Unveils GPT-Red, an Internal AI That Attacks Its Own Models to Harden Them Against Prompt Injection

July 15, 2026 at 17:59 EDT

Security
Foundation Models
AI Agents

OpenAI has introduced GPT-Red, an internal-only artificial intelligence built to discover prompt-injection vulnerabilities at scale and then used to adversarially train its newest models against them. The company detailed the system in a July 15, 2026 announcement, framing it as a step toward automated, self-improving safety in which current models help harden future ones.

July 15, 2026 · OpenAI

GPT-Red: an AI that hacks OpenAI's own models — to make the next ones tougher

An internal-only, self-play trained red-teaming model finds prompt-injection flaws at scale, then those attacks are used to adversarially harden GPT-5.6 Sol against manipulation.

84%

GPT-Red attack success rate vs GPT-5.1

13%

Human red-teamers on the same arena

0.05%

GPT-5.6 Sol failure rate on direct injections after training

Attack success rate — same prompt-injection arena

Automated red-teaming lands attacks ~6× more often than humans

84%

GPT-Red
(AI attacker)

13%

Human
red-teamers

The self-improvement loop

Attacker
GPT-Red crafts prompt-injection attacks

→

Defender
Model is adversarially trained on them

→

Hardened model
Each side pushes the other via self-play

"Fake Chain-of-Thought" attacks

Success rate collapses after adversarial training

95%

vs GPT-5.1

<10%

vs GPT-5.6 Sol

Indirect-injection benchmarks (developer tools, browsing) now show resistance above 97%, and GPT-5.6 Sol logs 6× fewer failures on the hardest direct-injection test than the best model four months earlier.

Case study · live agent "Vendy"

GPT-Red compromised an autonomous vending-machine agent in simulation, then transferred the attack to production — hitting all three targeted objectives:

Price manipulation

Unauthorized orders

Order cancellation

Welcomed

A self-improving loop lets defensive security keep pace with rising model power, as prompt injection becomes an acute risk for agents wired into email, code, browsers and cloud.

Cautioned

GPT-Red is internal-only and not a complete fix — its claims can't yet be independently verified. A forthcoming pre-print and third-party benchmarks will test whether the gains hold.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.