OpenAI Says GPT-Red Cut One Prompt-Injection Failure Rate Sixfold. The Test Loop Remains Closed

• OpenAI says GPT-Red helped GPT-5.6 Sol record six times fewer failures on one difficult direct prompt-injection benchmark.
• The company’s 84%, 13%, 0.05% and sixfold figures describe different evaluations and cannot be combined into one security rate.
• GPT-Red stays internal, its training used compute comparable to some of OpenAI’s largest post-training runs, and it still misses attacks humans find.
• Automated reinforcement-learning attacks already exist outside OpenAI, but the available material offers no matched cost or performance comparison.

OpenAI says a proprietary attacker now feeds exploits back into the development of its production models. The consequential result is not that prompt injection has been solved. It is that OpenAI has built a repeatable, compute-intensive test-and-hardening loop—and reported a sixfold reduction on one benchmark without releasing GPT-Red or the technical detail needed to reproduce the comparison.

Five results, five different scopes

In its announcement, OpenAI said GPT-5.6 Sol had six times fewer failures on its hardest direct prompt-injection benchmark than its best production model four months earlier. The company attributed that improvement to attacks generated by GPT-Red and used to harden GPT-5.6.

That headline is a relative result with no starting failure rate in the published text. OpenAI disclosed other percentages, but each comes from a different test:

OpenAI also said it tested for a common false gain: a model that appears secure because it refuses more legitimate work or loses capability. The company said normal capabilities were unaffected and targeted over-refusal tests did not show that tradeoff. The archived material does not provide the underlying scores or a third-party replication.

Self-play produces attacks—and a proprietary data loop

GPT-Red was trained through self-play reinforcement learning against a collection of defender models. The attacker receives a reward for causing a valid failure. The defenders are rewarded for resisting the attack while completing the original task. Their environments put hostile instructions in webpages, email bodies, local files and tool output, forcing the attacker to change tactics as the defenders improve.

OpenAI says the finished attacker can break nearly all internal and production models it faced through GPT-5.5. It then used GPT-Red to generate prompt injections for GPT-5.6. Precursors—not necessarily the finished GPT-Red model—have contributed attacks to the development of each successive production release since GPT-5.3 over roughly six months.

The infrastructure requirement is part of the result. OpenAI says GPT-Red used compute comparable to some of its largest post-training runs, which it described as an unprecedented safety-only allocation. Researchers involved in the project said in the same report that the work took more than a year and would not be trivial to copy.

That does not show the approach is economical. No dollar cost, inference budget or matched comparison with a smaller attack system appears in the retained material. The data loop may give OpenAI an advantage—its attacker finds failures, and those failures become inputs for later model development—but the size and value of that advantage remain unmeasured.

Nor is automated attack generation unique to GPT-Red. AutoInject, described in an academic preprint first submitted in February 2026, is a black-box reinforcement-learning system that learns adversarial suffixes for prompt injection. Its authors report online query-based attacks and offline-trained transferable suffixes, and say it outperformed template attacks, GCG, TAP and adaptive attack across production models on AgentDojo. That is not a head-to-head result against GPT-Red. It does show that automation and reinforcement learning alone are not OpenAI’s differentiator.

The live-agent tests show why model scores are not enough

GPT-Red’s most concrete case study targeted Vendy, an Andon Labs agent managing a vending machine in an OpenAI office. GPT-Red developed attacks against a close simulator, transferred them to the production agent and achieved all three objectives set by OpenAI:

• lower an expensive in-stock item to the permitted minimum price of $0.50;
• order an item worth more than $100 and offer it for $0.50; and
• cancel another customer’s order.

OpenAI said it disclosed the vulnerabilities and that new safeguards were being tested. The exercise demonstrates that injected instructions can trigger transactions when an agent has tools and authority. It does not reveal the attack success rate across repeated trials, the simulator-to-production failure rate or whether the production system’s permissions represented a typical deployment.

OpenAI also tested GPT-Red against a Codex CLI agent based on GPT-5.4 mini in 10 held-out data-exfiltration scenarios. It said the specialist attacker succeeded in more scenarios and used fewer tokens than a normally prompted GPT-5.5 baseline. The result suggests an advantage from specialization, but the archived account does not isolate that effect from model or resource differences and does not give a complete compute or dollar-cost comparison.

Those gaps matter because model hardening is only one control. OpenAI’s earlier security guidance says input filtering cannot reliably identify contextual manipulation and that systems must constrain the consequences even when attacks succeed. Its examples include blocking or confirming sensitive transmissions, sandboxing applications and placing deterministic limits on what an agent can do. GPT-Red can supply harder test cases; deployment controls still set the blast radius.

Closing the attacker while extending the testing platform

OpenAI will not release GPT-Red. The company says it keeps the attacker separate from deployed models so the malicious capabilities deliberately developed in it do not reach adversaries. That containment choice also means customers and independent researchers cannot run the attacker, inspect its coverage or reproduce the headline results directly.

Humans remain part of the test stack. Researchers involved in GPT-Red said it is weak at attacks that require long back-and-forth exchanges and at hiding instructions in images. Human testers still find failures it misses; OpenAI says GPT-Red will supplement human and third-party red teams, layered safeguards and real-time monitoring rather than replace them. OpenAI’s outside Red Teaming Network dates to 2023, according to an account of the program.

The company is also moving automated testing closer to customers. In March, OpenAI announced an agreement to acquire Promptfoo, whose tools test and red-team AI applications. OpenAI said Promptfoo’s technology would become part of its Frontier enterprise-agent platform, with testing, remediation records and governance features built into development workflows. The announcement did not state a purchase price, and closing remains subject to customary conditions.

That deal is not simply a shift from open tools to a closed stack. OpenAI said it would continue Promptfoo’s open-source command-line tool and library while building integrated Frontier capabilities. It also said Promptfoo’s products were trusted by more than 25% of Fortune 500 companies, a company-supplied measure of distribution rather than an independently audited adoption figure.

The next proof is a reproducible, budget-matched test

OpenAI says it will scale GPT-Red with more compute, data and algorithmic improvements. Before another scale-up can establish that GPT-Red is more than an effective internal system, the missing evidence is a reproducible comparison that keeps attack targets, privileges and budgets constant.

The technical preprint OpenAI promised for later in the week needs to disclose benchmark denominators, per-target attack budgets, how attempts were selected, and the capability and over-refusal results behind its claims. A useful human comparison would match elapsed time and access. A useful automated comparison would put GPT-Red against systems such as AutoInject on the same agents and report tokens, compute and cost—not only successful scenarios.

Independent testing must also cover the known gaps: multi-turn manipulation, image-borne instructions, agent harnesses outside OpenAI and deployments with realistic permission boundaries. Until that evidence exists, the defensible conclusion is narrow. GPT-Red appears to give OpenAI a powerful way to turn discovered prompt injections into harder production models. The public record does not yet show how much security that closed loop buys per unit of compute, or how well its gains transfer beyond tests OpenAI designed or replicated.