What is self-play red-teaming?

It is training an attacker model and a defender model against each other with reinforcement learning: the attacker is rewarded for finding attacks that actually elicit a failure, and the defender is rewarded for resisting those attacks while still completing the user's task. OpenAI's GPT-Red is the attacker half. Because each side improves against the other's current best, neither can coast — and the attacks the attacker discovers are then folded back in as adversarial training data for the model OpenAI ships.

Why does it matter who finds the attacks?

Because every other agent defense is built against a known set of attacks, so whoever generates that set sets the ceiling for all of them. OpenAI reports that human red-teamers cracked 13% of a replicated indirect-injection set while GPT-Red cracked 84% of the same set — a gap of roughly 71 percentage points of coverage, though OpenAI does not report how far the two sets overlap. Attacks nobody finds are attacks no filter or eval ever gets built against, and closing a gap that size by hand is slow work; automating the attacker is the bet OpenAI is making here.

How does GPT-Red relate to the lethal trifecta?

They work at different layers. The lethal trifecta is structural: an agent holding private data, reading untrusted content, and owning an exfiltration path is dangerous by construction, so the fix is to cut one of the three legs. GPT-Red does not remove a leg — it makes the model itself harder to hijack, with OpenAI reporting GPT-5.6 Sol failing on 0.05% of GPT-Red's direct injections. Note that headline number is a direct-injection result, while the trifecta's untrusted-content leg is the indirect case. So it is a strong layer, not a replacement for capability scoping — which is exactly the defense-in-depth argument.

OpenAI trains GPT-Red to harden agents against prompt injection — Self-play red-teaming

TL;DR

What is it: GPT-Red is an internal OpenAI model trained by self-play reinforcement learning to invent prompt injections — attacks hidden in content an agent reads — and the injections it discovers are folded back in as training data for the model OpenAI actually ships.
Why it’s needed: Every other agent defense — input filters, guard models, evals — is only as good as the attacks it was built against, so the part of the pipeline that manufactures the attacks quietly sets the ceiling for all of them; OpenAI reports this loop helped make GPT-5.6 Sol its most injection-robust model so far.
vs previous: Where human red-teamers hand-write attacks one scenario at a time and cracked 13% of a replicated indirect-injection set, GPT-Red cracked 84% of the same set — the manual approach doesn't fail, it just can't cover an attack surface this wide fast enough to keep up.

Think of it as

a vaccine lab that breeds the virus it is inoculating against

the strain bred in the lab = GPT-Red, an attacker model whose only job is to find a way past the defenses
breeding it against the current immune system each round = self-play RL, where the attacker is rewarded only for attacks that actually land
the immune system must fight it off and keep the body running = the defender is rewarded for resisting the attack and still finishing the user's task
the one door the lab lets the strain come through = the threat model: attacker-controlled text in a file, a webpage banner, an email body, or a tool result
the inactivated strain in the syringe = the discovered injections, folded back in as adversarial training data for GPT-5.6
the live strain never leaves the lab = GPT-Red is kept separate from the deployed models

Jargon

Prompt injection: Text an attacker plants in content the model reads — a document, a webpage, a tool's output — that the model then follows as if it were an instruction from the user. The model has no reliable way to tell data it was given from orders it was issued. See the lethal trifecta →
Direct vs indirect injection: Direct means the attacker types at the model themselves. Indirect means the payload waits inside something the agent will fetch later — the email it summarizes, the page it browses. Indirect is the harder problem, because the attacker never has to meet the agent.
Red-teaming: Deliberately attacking your own system to find the holes before someone hostile does. Traditionally a human job; GPT-Red is OpenAI's attempt to make it a trained model's job.
Self-play reinforcement learning: Two roles improve by playing against each other, each one's progress raising the bar for the other. Here the attacker is rewarded for eliciting valid failures and the defender for resisting them, so neither can coast.
Threat model: The explicit statement of what the attacker controls — in GPT-Red's environments, things like part of a local file, a webpage banner, an email body, or a tool result. Without one, "is it secure?" has no answer, because the question is secure against whom, holding what.
Adversarial training data: Successful attacks fed back into the training set so the model learns to refuse them. This is the step that turns a found vulnerability into one the model has been trained to refuse — the syringe, not the diagnosis. Trained-to-refuse is not the same as gone: the reported failure rates drop, they don't reach zero.
Fake Chain-of-Thought attack: An attack class OpenAI names but does not spell out in the post; the name describes an injection dressed up as the model's own reasoning, so the hijack reads like a thought the model had itself rather than an order from a stranger.

The news. On July 15, 2026, OpenAI published GPT-Red, an internal automated red-teaming model trained to hunt prompt-injection and tool-use vulnerabilities before deployment. OpenAI reports it found successful attacks on 84% of replicated indirect-injection scenarios versus 13% for human red-teamers, and that folding its discoveries into training helped make GPT-5.6 Sol its most injection-robust model so far — 6× fewer failures on its hardest direct-injection benchmark than the best production model from four months earlier. The post includes live-agent case studies against a vending-machine agent and a Codex CLI data-exfiltration suite. Read the announcement →

Picture a vaccine lab. The useful thing in the building isn't the syringe — it's the freezer full of nasty strains, because you can only immunize against a disease you have a live sample of. A lab that waits for new strains to show up in the wild is always a season behind; a lab that breeds them on purpose, deliberately raising each one against the current immune system, gets to meet next year's outbreak this morning. That is uncomfortable work, and it is also the only reason the syringe has anything in it. A defense only improves as fast as someone invents new attacks against it — so OpenAI automated the inventing.

Drop the metaphor and the mechanism is precise. GPT-Red is trained with self-play reinforcement learning: an attacker model is rewarded for eliciting failures that actually land, while defender models are rewarded for resisting the attack and still completing the user's task. That second half of the defender's reward is doing real work — a model that refuses everything is perfectly injection-proof and perfectly useless, so the reward has to price both. Each environment pins down a threat model: the attacker controls part of a local file, a webpage banner, an email body, or a tool's output — one specific door into the agent's context, not a vague "assume bad input."

The part that makes this a flywheel rather than a fancy test suite is what happens to the attacker's findings. GPT-Red never ships: OpenAI keeps it separate from the deployed models, and only its output travels — the injections it discovers become adversarial training data for GPT-5.6. The live strain stays in the lab; the inactivated one goes in the syringe. This is a different move from bolting an input filter in front of the model, which tries to catch the attack at the door; here the attack is folded into the model's own training so the door matters less. Both are worth having — that is the whole argument for defense-in-depth — but only one of them gets stronger every time the attacker gets smarter.

Here is what OpenAI reports the loop produced. Note that the first row measures the attacker's reach and the rest measure the defender's hardening — the flywheel is that the first row is what makes the others possible:

What was measured	Before	After
Replicated indirect-injection scenarios cracked	13%, by human red-teamers	84%, by GPT-Red (OpenAI)
Hardest direct prompt-injection benchmark	best production model, four months earlier	6× fewer failures for GPT-5.6 Sol (OpenAI)
Fake Chain-of-Thought attacks	upwards of 95% success on GPT-5.1	below 10% on GPT-5.6 Sol (OpenAI)
GPT-Red's own direct injections	—	GPT-5.6 Sol fails on 0.05% (OpenAI)

Hold the set fixed and the gap gets concrete. Take 100 scenarios from that replicated indirect-injection set. Human red-teamers land an attack on 13 of them; GPT-Red lands on 84. The interesting number is neither of those — it's the gap of 71 percentage points of coverage between them (a derived figure: arithmetic on the two reported rates. OpenAI doesn't report how far the two sets overlap, so this is the spread between them, not a roster of scenarios only the machine found). That gap isn't a scoreboard; it's raw material, because an attack nobody found is an attack nobody trained against. Now follow the same loop out the other side: fake Chain-of-Thought attacks landed on over 95 of every 100 attempts against GPT-5.1, and on fewer than 10 of every 100 against GPT-5.6 Sol — the same trick, from working at least 19 times in 20 to failing more than 9 times in 10 (derived from the reported rates). And against GPT-Red's own direct injections, GPT-5.6 Sol fails on 0.05% — about 1 in 2,000 (derived), which is the number you'd expect from a model trained on the attacker's greatest hits.

Read the four numbers in order and they tell one story, though it's worth being careful about what they don't say. A model measured against the attacker it trained on is graded by a friendly examiner, and OpenAI's post is a report on its own system, not an independent audit. The two headline defense numbers — 0.05% and 6× fewer failures — are both direct-injection results, while the case that actually haunts agents is the indirect one, where the payload waits inside a page nobody screened. And the lethal trifecta is structural: private data, untrusted content, and an exfiltration path in the same agent is dangerous no matter how well the model resists, which is why capability scoping doesn't become optional just because the model got harder to hijack. What the loop changes is the tempo. The bottleneck on agent security was never the defense; it was the supply of attacks to defend against — and that supply just stopped being limited by how many humans you can hire to be creative.

Goes deeper in: AI Agents → Security & the Lethal Trifecta → The Lethal Trifecta

Related explainers

Camouflage Injection — Camouflage Detection Gap — the attack side of the same fight: injections rewritten in a document's own vocabulary slip straight past detectors
AgentDoG 1.5 — Small inline guard models — the other half of defense-in-depth: catch the action at the door instead of training the model to refuse it
Role-Agent — One LLM as agent and environment — self-play pointed at capability rather than safety, and with both roles inside one model
kNNGuard — Training-free activation-space guardrail — a defense that needs no adversarial training data at all, for contrast

Frequently Asked Questions

Check what you knowMap your AI & GPU knowledge across every track — free, role-based