OpenAI introduces GPT-Red to make AI more robust

OpenAI has created GPT-Red, a model designed to attack other AI systems and uncover their weak points before they reach more users. The company is using it to train GPT-5.6 Sol against one of the toughest problems facing current agents: instruction injections.

An instruction injection occurs when a malicious command slips into an email, website, file, or tool response. The agent may mistake that command for a legitimate instruction and, for example, try to send private data to an external server.

An automated attacker that learns from its own failures

Until now, many of these tests relied on human security teams. They are useful, but slow and difficult to scale. Each new model may need thousands of different attacks to reveal unexpected behavior.

GPT-Red automates that work. It sends an instruction, observes how the target model responds, and changes its strategy if the attack fails. Its training uses reinforcement learning through competition: GPT-Red receives a reward when it manages to trigger a failure, while several defender models receive another reward when they resist and complete their original task.

As the defenders improve, the attacker has to find more complex methods. OpenAI trained GPT-Red with an amount of computing comparable to some of its largest post-training adjustment phases, dedicated specifically to security.

What results has it achieved

The company says GPT-Red can break almost every model it was tested against, including internal and production models up to GPT-5.5. It then used the attacks generated by GPT-Red to train GPT-5.6 Sol.

According to OpenAI, the new model records six times fewer failures on its most difficult direct-injection test than the company’s best production model from four months earlier. Across a broad set of tests, GPT-5.6 Sol gave in to just 0.05% of GPT-Red’s direct injections.

The model was also tested in scenarios it had not seen during training:

• It successfully found attacks in 84% of the scenarios in an independent test, compared with 13% achieved by human teams.
• It manipulated an agent managing a vending machine to lower the price of an expensive product to $0.50, sell another item worth more than $100 for that amount, and cancel another customer’s order.
• It managed to trigger the extraction of sensitive data in more scenarios than a GPT-5.5 model used as a benchmark when attacking a command-line agent based on GPT-5.4 mini.

The vending machine vulnerabilities were reported, and the new defenses are still being tested. The case serves as a controlled demonstration of what can happen when an agent has access to tools and the ability to execute actions.

The challenge: improving security without making the model useless

A system can appear safer simply by rejecting almost everything. That would reduce some attacks, but it would also stop the agent from performing legitimate tasks.

OpenAI says it tested GPT-5.6 Sol on general capabilities and specific over-refusal tests. According to its results, normal capabilities were maintained while resistance to malicious instructions increased. The improvement would come from better distinguishing a valid command from a manipulative one, not from blocking more requests by default.

GPT-Red will not be deployed as a product. OpenAI is keeping it separate from its public models so it does not hand potential attackers the offensive capabilities it acquired during training.

The approach has already been applied to successive versions since GPT-5.3. An attack called “Fake Chain-of-Thought,” which achieved more than 95% success against GPT-5.1, now falls below 10% against GPT-5.6 Sol, according to the company.

The core idea is to create a cycle of improvement: one model searches for failures, another learns to resist them, and the next model starts with a more demanding defense. OpenAI plans to expand the process with more data and computing, while continuing to combine it with human evaluators, external testing, and real-time monitoring. The decisive question will be whether that resistance also holds up in new applications, where the attacks have not yet been defined.