GPT-Red

OpenAI's GPT-Red is an attacker model trained to generate prompt-injection attacks: malicious instructions placed in material an AI system reads, such as an email, webpage or tool output. In the company's account, GPT-Red is rewarded for eliciting a valid failure, while defender models are rewarded for resisting and completing their original tasks, so stronger defenders force stronger attacks. OpenAI says it then used GPT-Red's attacks to train GPT-5.6, which became highly resistant to them, and reports 6x fewer failures for GPT-5.6 Sol than its best production model four months earlier on its hardest direct prompt-injection benchmark. GPT-Red is kept internal and separate from deployed models.