GPT-Red Is OpenAI's Strongest New Model, and You Will Never Get to Use It

OpenAI trained an attacker at flagship compute to break its own agents. The robustness numbers are real. The catch is that the attacker your users meet won't be this one.

The most capable model OpenAI shipped this week has no API endpoint, no ChatGPT toggle, and no plans for either. It is called GPT-Red, it was announced on July 15, and its entire job is to break OpenAI's other models. The company says it trained GPT-Red "at the compute scale of some of our largest post-training runs," which is the kind of budget you spend on a flagship you intend to sell. OpenAI intends to sell none of it. GPT-Red stays locked inside the building.

That decision is the story. A frontier lab just spent flagship money building a model it will never monetize, purely so it could point that model at its own agents and watch them fall over. Read the announcement and the numbers explain why: on an internal mirror of an academic prompt-injection benchmark, GPT-Red found working attacks in 84% of scenarios where human red-teamers managed 13%. The machine is roughly six times better at breaking things than the people whose job was breaking things.

Why a model built to lose matters

Prompt injection is the unglamorous security problem that will not go away. An agent reads an email, a webpage, a file, a tool result, and somewhere in that text is an instruction the attacker wrote: upload this directory, forward that API key, cancel the other customer's order. The model has no reliable way to tell your instruction from the attacker's, because to the model they are both just text arriving in the context. This is the same architectural hole that produced a spring of agent RCE bugs and a stack of CVEs, and it does not have a clean patch.

OpenAI's bet with GPT-Red is that you fight a scaling problem with scale. Human red teams do not scale. A person can craft a clever injection, but a person cannot generate the millions of diverse attacks you need to actually train a model to resist the whole class. Worse, OpenAI's own robustness benchmarks were already saturated, meaning the current models scored near the ceiling and the tests could no longer tell a good defense from a great one. When your ruler stops measuring, you need a longer ruler. GPT-Red is the longer ruler.

Here is why that should matter to anyone shipping an agent. The gains are not coming from prompt hygiene, input filters, or a system prompt that politely asks the model to distrust tool output. OpenAI tested that last one and it failed. The gains are coming from training against a dedicated adversary. If the strongest defense a top lab can build requires an attacker model at flagship compute, then the "just add a guardrail" era of prompt-injection defense is over, and you should stop expecting a config flag to save you.

How self-play actually works here

GPT-Red is trained through self-play reinforcement learning, and the mechanism is worth understanding because it explains both the power and the limit.

Picture two sides trained at the same time. On one side is GPT-Red, the attacker. On the other is a population of defender models running normal tasks. Each training scenario has a threat model that says exactly what the attacker controls: maybe a line in a local file, maybe a webpage banner, maybe the body of an email, maybe the output of a tool. GPT-Red gets rewarded when it makes a defender fail, for example by landing a prompt injection that exfiltrates data. The defenders get rewarded when they resist the attack and still finish their real work.

Then the ratchet turns. As the defenders get harder to fool, GPT-Red is forced to invent stronger and stranger attacks to keep earning its reward. As GPT-Red gets nastier, the defenders have to get tougher to keep earning theirs. Neither side is allowed to sit still. That is the whole trick, and it is genuinely clever: the training data for robustness generates itself, and it gets more adversarial exactly as fast as the models can handle.

The loop produces more than a strong attacker. Once GPT-Red finished training, OpenAI fed its attacks into the training of GPT-5.6. The company reports that GPT-5.6 Sol now fails on 0.05% of GPT-Red's direct prompt injections, and shows six times fewer failures on its hardest direct-injection benchmark than OpenAI's best production model from four months earlier. One concrete example makes it vivid: an early version of GPT-Red discovered a "Fake Chain-of-Thought" attack, where the attacker inserts spoofed reasoning steps into the model's own thinking to steer it. That attack hit above 95% success on GPT-5.1. On GPT-5.6 Sol it is now below 10%. The machine found the wound and then helped stitch it.

The part where it works on things that aren't a benchmark

Benchmarks are one thing. OpenAI also pointed GPT-Red at live systems, and this is where the write-up stops being reassuring.

They set it against an autonomous vending-machine agent running in the OpenAI office, a real deployment built by Andon Labs, similar to Anthropic's Project Vend. GPT-Red practiced its attacks in simulation, then transferred them to the production agent and achieved all three of its malicious goals: it dropped the price of an expensive in-stock item to the $0.50 floor, ordered a new $100-plus item and listed it for $0.50, and canceled a different customer's order. OpenAI disclosed the holes and says fixes are being tested.

Then they aimed it at a Codex CLI agent, the actual coding assistant, on a suite of ten held-out data-exfiltration scenarios. GPT-Red got that agent to leak sensitive data in more scenarios than a strong prompted baseline, and did it using fewer tokens. Read that twice. The attacker trained on a walled-off population of defenders generalized well enough to break a live coding agent it had never specifically trained against, and it was efficient about it. Attack transfer, the property every defender hopes is weak, turned out to work better than anyone should be comfortable with.

Put this into practice

You cannot download GPT-Red, but the release changes what you should be asking for and doing this week. None of this requires a research budget.

1. Change your vendor question from "is it safe" to "what's the attack success rate." OpenAI just made attack success rate the unit of measurement. When you evaluate a model or an agent platform for anything that touches untrusted input, ask the vendor for their prompt-injection failure rate against a named adversary, not a vibes-based assurance that they take safety seriously. If they can't give you a number and a source, that is your answer.

2. Treat the chain of thought as attackable surface. The Fake Chain-of-Thought attack means an adversary who can influence text the model reads may be able to forge reasoning steps. If your system logs, displays, or acts on the model's thinking, do not treat that thinking as trusted narration. It is model output shaped by everything in the context, including the attacker's plant.

3. Assume attack transfer and move the boundary off the model. GPT-Red broke a live Codex agent it never trained on. The lesson for your stack is that a defense tuned to one attacker will not hold against a different one, so put the real controls where they do not depend on the model winning an argument: approval-in-the-loop for anything irreversible, credentials out of the environment the agent can read, limited outbound network egress, and host-level detection. These fire whether or not the model gets fooled.

4. Red-team your own agent with a cheap adversary now. You do not need flagship compute to start. Point a capable model at your agent with the explicit goal of making it exfiltrate a canary secret you planted, across your real tool surface. You will not match GPT-Red, but you will find the embarrassing holes, and you will build the habit of measuring instead of hoping.

The honest limitations, and they are large

Every impressive number in this release has the same shape: OpenAI grading OpenAI's defense against OpenAI's attacker. That is not a small caveat, it is the whole frame.

The 0.05% failure rate is measured against GPT-Red's attack distribution. GPT-5.6 Sol resists the specific adversary it was trained against, which is exactly what self-play should produce and also exactly the problem. Self-play converges toward resisting the attacker in the room. The attacker your users actually meet will be someone else's model, someone else's technique, someone else's incentive, and there is no reason to assume the 0.05% number survives contact with an adversary that was not part of the training loop. The vending-machine and Codex results show transfer works in OpenAI's favor when OpenAI runs the attacker. Nobody has shown what happens when a comparable attacker OpenAI did not build runs the other direction.

"Six times fewer failures" is a real improvement and a claim with one witness. There is no third party running an attacker model of similar scale against these systems. Until someone outside OpenAI does, the robustness story rests entirely on the honesty and completeness of OpenAI's own evaluation, and a lab has every incentive to test the attacks it already knows how to beat. OpenAI deserves credit here for publishing this at all; most labs disclose nothing like it. Disclosure is not the same as independent verification.

There is also a quieter risk in the flywheel itself. OpenAI frames GPT-Red as "self-improvement for safety," today's models making tomorrow's models safer. That is a nice loop when it works. It also means the safety of the next model increasingly depends on the judgment of the previous one, and a blind spot the attacker model never learned to probe becomes a blind spot the defender never learned to cover. A system that grades itself can get very good at the test and still miss the thing the test does not contain.

What to watch

The preprint is promised later this week, and it is the thing to actually read, because the details OpenAI chose to publish will tell you more than the blog's headline percentages. Look for how the held-out environments were selected, whether the transfer results hold against attackers built on non-OpenAI models, and whether the robustness gains survive on tasks the defender population never saw.

The bigger question GPT-Red leaves open is one you get to answer for your own stack. If the strongest prompt-injection defense on the planet is a lab training against its own adversary at flagship scale, and that defense still only provably beats the adversary it trained on, then betting your agent's safety on the model resisting attacks is betting on the wrong layer. The model will get fooled eventually. The interesting engineering is in what still holds when it does. That work does not need a preprint, and you can start it today.

Sources: OpenAI, "GPT-Red: Unlocking Self-Improvement for Robustness" (July 15, 2026); Dziemian et al. (2025), indirect prompt injection arena, arXiv:2603.15714; The Hacker News coverage.