OpenAI has developed GPT-Red, an internal automated red-teaming model designed to attack its own AI systems, surface vulnerabilities, and drive measurable improvements in prompt-injection resilience. Unlike traditional security tools aimed at conventional software, GPT-Red functions as an AI “super-hacker” built specifically to exploit other large language models, with a core mission centered on discovering, generating, and executing prompt-injection attacks autonomously.
GPT-Red operates by repeatedly sending adversarial prompts to target models, observing responses, and iteratively refining its attack strategies through trial-and-error search. This continuous feedback loop positions the model as a persistent internal security service, effectively working on behalf of human security teams to identify weaknesses before adversarial actors can exploit them in production environments.
GPT-Red autonomously probes, observes, and refines attacks in a continuous loop — acting as AI’s most tireless internal security guard.
The performance gap between GPT-Red and human red-teamers is substantial. On identical novel indirect prompt-injection tests, GPT-Red achieves an 84% attack success rate compared to just 13% for human testers. That capability gap translates directly into more extensive vulnerability coverage and faster identification of exploitable patterns that manual testing would likely miss.
The practical impact on model hardening has been significant. Using GPT-Red’s attack outputs as adversarial training data, OpenAI reduced direct prompt-injection failures in its latest production model by sixfold compared to a version released four months earlier. The “fake chain-of-thought” attack family, which previously succeeded in over 95% of cases against GPT-5.1, now succeeds in fewer than 10% of cases against GPT-5.6 following targeted exposure to GPT-Red discoveries.
GPT-5.6 Sol, OpenAI’s most capable cybersecurity-oriented model to date, reflects the cumulative effect of this hardening process. Overall attack success rates dropped from over 90% on earlier GPT-5 versions to under 23% on GPT-5.6. On GPT-Red’s hardest direct prompt-injection attempts, GPT-5.6 Sol fails only 0.05% of the time. Several indirect prompt-injection benchmarks in developer tool and browsing contexts have also reached saturation, with GPT-5.6 surpassing 97% accuracy after hardening informed by GPT-Red data.
GPT-Red’s testing scope extends beyond isolated model evaluations to real-world autonomous agent environments. Demonstrations include compromising a Vendy vending machine agent, where GPT-Red successfully altered prices and canceled orders, and targeting command-line coding agents operating in practical deployment scenarios. These results underscore the risks facing agentic AI systems and validate GPT-Red’s role in exposing vulnerabilities that extend well beyond simple text-based interactions.
OpenAI reports that GPT-Red can compromise nearly every internal and production model tested up to and including GPT-5.5, providing broad coverage across the model family. The system creates a self-reinforcing security cycle where discovered exploits directly inform defensive training, consistently lowering failure rates with each iteration and reducing production prompt-injection failures to roughly one-sixth of previous levels. This development aligns with broader industry momentum, as SiliconANGLE’s theCUBE network has positioned AI and cybersecurity as two of the most critical intersecting domains shaping enterprise technology conversations today.
