OpenAI's GPT-Red beats humans at prompt injection red teaming

OpenAI has developed GPT-Red, an automated red-teaming model that uses self-play reinforcement learning to discover prompt injection weaknesses more effectively than human testers. In a replicated benchmark based on Dziemian et al. (2025), GPT-Red succeeded on 84% of indirect prompt injection scenarios against GPT-5.1, while human red teamers succeeded on only a small fraction. The model also broke nearly every target it faced, including GPT-5.5. Real-world tests confirmed its potency: GPT-Red compromised an AI-run vending machine (built by Andon Labs) by lowering a product price to $0.50, listing a new item at that price, and canceling an existing order. It also outperformed a prompted GPT-5.5 baseline in data exfiltration from a Codex command-line agent.

OpenAI has integrated GPT-Red's attack strategies into production model training since GPT-5.3. The current flagship, GPT-5.6 Sol, shows a 6x reduction in direct prompt injection failures compared to the best model from four months earlier. An early GPT-Red discovery—'Fake Chain-of-Thought'—previously fooled GPT-5.1 95% of the time; on GPT-5.6 Sol, that rate is below 0.1%. Indirect prompt injection benchmarks now exceed 97% accuracy on the new model, and direct injection failure rate is just 0.05%. Critically, GPT-5.6 Sol maintained its frontier capabilities and over-refusal scores, indicating it rejects malicious instructions without blocking legitimate ones. OpenAI plans to scale GPT-Red further and will publish a preprint with more details.