OpenAI says its GPT-Red red-teaming model cut prompt-injection failures to 0.05% on GPT-5.6 Sol

OpenAI has detailed GPT-Red, an internal automated red-teaming model trained specifically to find prompt-injection vulnerabilities in its production models at scale, and says the resulting adversarial training has sharply cut how often those attacks succeed against its newest flagship model.

What's new

According to OpenAI, GPT-Red works the way a human red-teamer would: it sends a prompt, observes how a target model responds, and iterates toward a working attack. OpenAI says the model was trained at the compute scale of some of its largest post-training runs — compute the company describes as an unprecedented amount dedicated purely to improving safety. The vulnerabilities and successful attacks GPT-Red discovers are then fed back into training future models to close the gaps.

The headline result: "With our latest model release, GPT-5.6 Sol fails on only 0.05% of GPT-Red's direct prompt injections." OpenAI also says GPT-5.6 Sol is its most robust model to prompt injection to date, achieving six times fewer failures on its hardest direct prompt-injection benchmark compared with its best production model from four months earlier. The company frames this as evidence that robustness against GPT-Red's own attacks has dropped monotonically release over release, and that attacks GPT-Red generates against older models increasingly fail against newer ones — more than 90% of GPT-Red's strongest attacks worked against GPT-5, versus fewer than 23% against GPT-5.6.

Context

Prompt injection — getting a model to follow instructions hidden in retrieved content, tool outputs, or user input rather than the developer's actual instructions — has become one of the most practically dangerous failure modes as models are wired into agentic systems with real-world tool access: browsing, code execution, email, and file systems. Manual red-teaming doesn't scale to the pace of model releases or the size of the attack surface those integrations create, which is the bottleneck OpenAI says motivated building an automated red-teamer in the first place.

This approach — using one model to attack another and training on the results — mirrors adversarial and reinforcement-learning-style safety work happening across the industry, where labs increasingly treat red-teaming itself as a capability to be scaled with compute rather than a purely manual review process.

Why it matters

If OpenAI's numbers hold up under outside scrutiny, a 6x reduction in failures on the hardest injection benchmark, in four months, is a meaningful robustness gain for anyone building agents on top of OpenAI's models — prompt injection is currently one of the most cited blockers to giving agents broader autonomy and tool access. It also signals a shift in how OpenAI is allocating its safety compute: dedicating post-training-scale resources to an internal attacker model, rather than only to capability gains, suggests the company sees automated adversarial testing as a prerequisite for shipping more autonomous agentic products. The claims are self-reported and internal-only (GPT-Red itself has not been released), so independent verification by third-party red-teamers will be the real test of whether the robustness gains generalize beyond OpenAI's own benchmark suite.