A July 15, 2026 safety publication by OpenAI, accompanied by a paper, "GPT-Red: Automated Red Teaming via Self-Play at Scale."
The stated problem
OpenAI's framing is a scaling constraint on the assurance side rather than a new capability: red-teaming "is essential to discovering vulnerabilities and improving the robustness of our models. However, current approaches are not scalable, creating a bottleneck," and "commonly used robustness evaluations have already been saturated by our latest models."
The limit on human red-teaming is stated twice, in two forms. Designing and running exercises "is time-intensive, limiting how quickly we can identify new failure modes"; and separately, human exercises "cannot generate the volume and diversity of adversarial data needed to improve model robustness through training." The second is the one the method targets: human red-teaming produces findings, not a training corpus.
Method
GPT-Red is trained by self-play reinforcement learning in which "the model and a collection of diverse defender LLMs are trained simultaneously on a broad set of red-teaming scenarios." The attacker is rewarded for eliciting a valid failure and the defenders for resisting while completing their tasks, so that "as the defenders become more robust, GPT-Red is forced to discover stronger and more diverse attacks." Each environment carries a threat model specifying what the attacker controls — "part of a local file, a webpage banner, an email body, or output of a tool."
OpenAI states it trained GPT-Red "at the compute scale of some of our largest post-training runs at OpenAI—an unprecedented amount of compute dedicated purely for improving safety."
The model is not released: "We keep GPT-Red separate from the models we deploy. This keeps the malicious capabilities we specifically train into GPT-Red out of the hands of adversarial actors, while instilling robustness into our production models."
Reported results
| Measure | Result | |
|---|---|---|
| Held-out indirect prompt-injection arena (Dziemian et al. 2025 replication), vs GPT-5.1 | GPT-Red 84% of scenarios; human red-teamers 13% | |
| "Fake Chain-of-Thought" direct injections | >95% success on GPT-5.1; below 10% on [[models/gpt-56 | GPT-5.6 Sol]] |
| GPT-Red direct prompt injections vs GPT-5.6 Sol | 0.05% failure rate | |
| Hardest direct prompt-injection benchmark | 6× fewer failures than OpenAI's best production model four months earlier | |
| Indirect injection benchmarks (developer tools, browsing) | saturated, >97% accuracy |
At the end of training the attacker "can break nearly all models it is pitted against, both internal and production models up to and including GPT-5.5." Precursor red-teamers have been used in the training of each production model since GPT-5.3.
Transfer to live systems
The disclosure includes an attack on a production agentic system: an AI-operated vending machine in the OpenAI office produced by Andon Labs, comparable to Anthropic's Project Vend. Given a system description and a simulator, GPT-Red iterated attacks and then "deployed its attack against the production agent, achieving all three of its malicious objectives" — repricing an expensive in-stock item to the $0.50 floor, ordering a new $100+ item and offering it at $0.50, and cancelling another customer's order. OpenAI states the vulnerabilities were disclosed and new safeguards are in testing.
A second study attacked a Codex CLI agent based on GPT-5.4 mini across ten held-out data-exfiltration scenarios, where GPT-Red was "both more effective… and is more token efficient" than a prompted GPT-5.5 baseline.
The capability control
OpenAI states the objection to its own headline metric and addresses it: "A model can appear safer by refusing more requests or becoming less capable. A model that does less is naturally harder to attack, but that is not useful robustness." It reports evaluating general frontier capabilities alongside "targeted over refusal tasks," finding "all normal capabilities remain unaffected."
All figures are OpenAI's own evaluations; no third-party replication accompanies the release.
The self-improvement framing
The closing argument connects the method to the capability flywheel: "AI agents are already being used to improve the capabilities of our next-generation models. We believe with GPT-Red that we have started to unlock a similar flywheel for safety, where today's models can be used to make tomorrow's models more robust, aligned, and trustworthy."
Relationships
- supports: Automated Alignment Research — a production instance of using models to do safety work at training scale
- supports: Jailbreaking and Red Teaming — supplies the automated-versus-human comparison
- related: Prompt Injection — the specific failure class trained against
- related: GPT-5.6 (Sol, Terra, Luna), OpenAI, Agentic AI