OpenAI trains AI to attack its own models, with a success rate of 84%, far higher than humans

According to Beating monitoring, OpenAI has released an automated red-teaming model, GPT-Red. It is designed to learn prompt-injection attacks through self-play, then uses the vulnerabilities it finds to train GPT-5.6. GPT-Red is for internal use only and will not be opened to the public.

In a set of new scenarios that were not involved in training, GPT-Red’s success rate in attacking GPT-5.1 reached 84%, while human red teams had only 13%. It also breached a vending machine Agent, lowering product prices and canceling other users’ orders. When testing Codex CLI, it could also induce Agents to leak sensitive data.

After adversarial training, GPT-5.6 Sol’s attack success rate against GPT-Red when directly subjected to prompt injection fell to 0.05%.