OpenAI Details GPT-Red, an Automated Attacker Trained by Self-Play to Harden Its Own Models

OpenAI published details of GPT-Red, an internal system trained with self-play reinforcement learning to attack the lab's own models before deployment. The attacker and a set of defender models train simultaneously: GPT-Red earns reward for eliciting a valid failure such as a successful prompt injection, while defenders are rewarded for resisting and still completing their task. As defenders harden, the attacker is pushed toward stronger and more diverse exploits.

OpenAI reports that automated red-teaming reached 84 percent attack success against 13 percent for human red teams in matched scenarios, and that GPT-Red independently discovered a "fake chain of thought" attack, inserting spoofed reasoning steps into another model's trace, before human researchers named it. The lab says it dedicated compute on the scale of its largest post-training runs purely to this safety work and incorporated the results into training for production models, including GPT-5.6.

The caveat is who is measuring. The 84-versus-13 gap is OpenAI's own evaluation of its own system, on scenarios OpenAI defined, with no external replication. The direction is credible and the self-play framing has academic precedent, but the specific gap should be read as a vendor result until an outside group reproduces it.