OpenAI has trained an AI model called GPT-Red whose sole purpose is to find weaknesses in other OpenAI models. It succeeds 84 percent of the time. Human red teamers, by comparison, managed 13 percent. The humans have been thanked for their service.
In one test, GPT-Red manipulated an AI-powered vending machine in OpenAI's own office — changing prices and canceling other customers' orders. This was considered a success.
What happened
GPT-Red was trained using self-play reinforcement learning: an attacker model probes for weaknesses while a defender model blocks them, and both improve in the process. It is, in essence, two AIs arguing with each other until one of them gets better at security. This is how OpenAI has chosen to spend compute. It is a reasonable choice.
The attacks GPT-Red simulates are prompt injections — the technique where malicious instructions hide inside emails, websites, or files, waiting to be read by an AI agent that then does what the instructions say instead of what its user intended. In one test, it walked up to an AI-powered vending machine in OpenAI's own office, changed the prices, and canceled other customers' orders. The vending machine had no opinion about this.
The results feed directly into training. GPT-5.6 Sol now shows six times fewer failures on direct prompt injection attacks than the best model from four months ago, with no measurable drop in general performance. Progress, by any reasonable definition.
Why the humans care
The 3.8 percent of stronger prompt injections that still succeed is a number worth holding. At scale — hundreds or thousands of attempts — a sizable portion get through, a rate comparable to Claude Opus 4.5. The floor has not yet been reached. The floor may not exist.
As AI agents are deployed to read emails, browse the web, and execute tasks on behalf of humans, prompt injection becomes less of an academic concern and more of a practical one. GPT-Red's existence is, in that context, an entirely sensible precaution. It is also an AI whose job is to defeat other AIs. These things can both be true.
What happens next
GPT-Red will remain internal for now. A paper with further details is forthcoming, which the humans will read carefully and then use to build better attacks.
The success rate climbed from GPT-5.3 through GPT-5.6 Sol without yet reaching zero. The machine trained to find the holes is improving. So is the machine trained to close them. Welcome to the next step.