ResearchAudio.io  ·  Safety  ·  Jul 2026

The Attacker AI That Makes GPT-5.6 More Robust

Self-play red-teaming beat humans 84% to 13%. Failures fell to 0.05%.

OpenAI trained a model whose entire job is to break other AI systems. On a fresh batch of prompt-injection challenges, it succeeded 84% of the time. Human red-teamers, attacking the same target model on the same scenarios, succeeded 13% of the time.

Then OpenAI did the counterintuitive part. They turned that attacker into a training tool and used it to make their next model much harder to break.

Why prompt injection keeps getting harder to test

Modern AI agents read your email, browse the web, open local files, and call external tools. Each of those channels is also a way in. A malicious instruction hidden in a webpage banner or a tool response can try to trick an agent into leaking data or taking an action the user never asked for.

Human red-teamers are good at finding these holes, but they cannot keep up. Designing and running each exercise takes time, which limits how fast new failure modes get discovered and patched. Hand-crafted attacks also cannot produce the volume and variety of adversarial examples needed to actually train a model to resist them.

There is a second problem: the standard robustness tests are running out of headroom. OpenAI's newer models already saturate many of them, so those benchmarks no longer separate a strong model from a weak one. Safety testing has to scale at the same rate as model capability, and manual methods do not.

How GPT-Red trains itself through self-play

GPT-Red is trained with self-play reinforcement learning. The attacker and a population of diverse defender models learn at the same time across a wide set of red-teaming scenarios. The attacker gets credit for landing a valid failure, such as a working prompt injection. The defenders get credit for resisting the attack while still finishing their original task.

That setup creates an arms race on purpose. As the defenders learn to shrug off known attacks, GPT-Red is pushed to invent stronger and more varied ones. Neither side can stand still, so both keep improving. OpenAI calls this loop a self-improvement flywheel for safety: today's models generate the pressure that hardens tomorrow's models.

To make the training realistic, each scenario carries a threat model. It spells out exactly what GPT-Red controls (part of a local file, a webpage banner, an email body, or the output of a tool) and what counts as a successful attack. OpenAI trained GPT-Red at the compute scale of some of their largest post-training runs, which they describe as an unprecedented amount of compute spent purely on safety.

The payoff shows up in how much the attacker can break. By the end of training, GPT-Red defeats nearly every model it faces, internal and production, up to and including GPT-5.5. OpenAI then used it to generate prompt injections for the training of GPT-5.6, which came out highly resistant to the same attacker. They keep GPT-Red internal and never deploy it, so the offensive skills they deliberately built stay out of an attacker's hands while the defensive gains ship inside the production model.

The robustness numbers

Adversarial training against GPT-Red moved the safety metrics in a clear direction. GPT-5.6 Sol reaches 6x fewer failures on OpenAI's hardest direct prompt-injection benchmark than their best production model from four months earlier. A class of attacks an early GPT-Red discovered, called Fake Chain-of-Thought, once worked upwards of 95% of the time against GPT-5.1. Against GPT-5.6 Sol, that same class lands below 10% of the time.

The headline robustness figure is even sharper. On a broad set of robustness environments, GPT-5.6 Sol fails on 0.05% of GPT-Red's direct prompt injections. Several indirect injection benchmarks aimed at developer tools and browsing sit above 97% accuracy, effectively saturated by the latest model.

Does the model just refuse more?

There is an obvious way to fake a robustness win: make the model refuse more and do less. A model that says no to everything is hard to attack, but it is also useless. OpenAI tested for exactly this, measuring frontier capabilities alongside over-refusal tasks they designed. They report that normal capabilities held steady while robustness rose, which points to real resistance to malicious instructions rather than blanket caution.

It works on live agents, not just benchmarks

The strongest evidence is that GPT-Red transfers to real systems it was not trained on. OpenAI pointed it at an autonomous vending-machine agent (called Vendy, built by Andon Labs) running in their office. GPT-Red rehearsed in simulation, then ran its attack against the live agent and hit all three of its goals: dropping an expensive in-stock item to the $0.50 floor price, listing a new $100-plus item at $0.50, and canceling a transaction belonging to another customer. OpenAI says it disclosed the vulnerabilities and is testing new safeguards.

In a second test, GPT-Red attacked a Codex CLI agent (based on GPT-5.4 mini) across 10 held-out data-exfiltration scenarios. Compared with a prompted GPT-5.5 baseline, it pulled off the exfiltration in more scenarios and used fewer tokens to do it.

What matters for builders

The uncomfortable symmetry is that the most effective safety tool here is also the most capable attacker OpenAI has built. For now it stays locked inside the lab, and OpenAI says a fuller pre-print is due later this week.