GPT-Red Trains OpenAI Models to Resist Prompt Injection

OpenAI has developed GPT-Red, an internal automated red-teaming model designed to discover safety weaknesses in advanced AI systems and generate adversarial examples that can be used during training. Red-teaming means deliberately attempting to make a system fail, violate its rules, or behave in an unsafe way so that those weaknesses can be corrected before deployment. OpenAI argues that this work has become a bottleneck because traditional evaluations are increasingly unable to challenge its newest models, while manually designed tests cannot keep pace with the growth in model capabilities.

The immediate focus is prompt injection, an attack in which malicious instructions hidden in external content attempt to override a model’s intended behavior. AI systems encounter third-party information when they browse websites, read emails and local files, use connected applications, inspect repositories, or process tool responses. These capabilities are necessary for useful real-world work, but they also expose models to content controlled by attackers. A planted instruction could, for example, try to persuade an AI assistant to send confidential information to an outside server.

Human security specialists remain an important part of OpenAI’s safety process because they can devise creative attacks, understand context, and identify previously unknown failure modes. However, human testing takes considerable time to plan and conduct. It produces valuable examples of successful attacks but not necessarily enough varied adversarial data to make models substantially more resistant through training. OpenAI’s central claim is that automated red-teaming can expand both the speed of vulnerability discovery and the volume of hostile examples available for improving future systems.

GPT-Red is presented as the company’s strongest automated safety red-teamer so far and the culmination of earlier internal experiments. It operates iteratively in a way that resembles a human tester: the model pursues an attack goal, sends a prompt to a target GPT model, observes the response, and adjusts its next attempt. This feedback loop allows it to search for attack strategies instead of relying only on a fixed collection of known prompts. OpenAI says previous production models remain highly vulnerable to the prompt-injection attacks GPT-Red generates.

The company devoted an unusually large amount of computing power to the system. According to OpenAI, GPT-Red was trained at a scale comparable with some of its largest post-training runs, with that compute dedicated specifically to safety improvement. The project therefore treats adversarial testing as a major training workload rather than a limited evaluation conducted after model development is nearly complete. The broader idea is a form of safety-focused self-improvement: models available today help expose weaknesses and create training data for safer models built next.

OpenAI incorporated attacks generated by GPT-Red directly into adversarial training for GPT-5.6 Sol. In adversarial training, the target model repeatedly encounters difficult attack examples and learns to resist them. The company reports that GPT-5.6 Sol produced six times fewer failures on its hardest direct prompt-injection benchmark than its best production model from four months earlier. OpenAI describes GPT-5.6 Sol as its most robust model against prompt injection to date, although the supplied material does not provide the benchmark’s underlying test set, absolute failure rates, or an independent replication of the result.

The reported gain does not mean that prompt injection has been eliminated. Automated attackers and defenders can continue to improve in response to one another, while real deployments may expose systems to situations not represented by an internal benchmark. The result instead demonstrates how a capable attack-generating model can be integrated into the production training cycle, continuously finding failure cases that become material for the next round of defensive training.

OpenAI plans to scale this automated approach as model capabilities advance, but it does not describe GPT-Red as a replacement for external scrutiny. The company says automated testing will remain one layer alongside human and third-party red-teaming, multiple technical safeguards, and real-time monitoring after deployment. Its proposed safety model is therefore layered: automated adversaries increase coverage and training volume, people contribute judgment and novel attack ideas, and monitoring helps detect failures that still reach operational systems.