GPT-Red: Self-Improvement for Robustness
OpenAI trains a specialized adversarial agent to discover prompt-injection failures and generate training data that improves the robustness of successor production models.
Does scaling automated red-team compute produce durable robustness against qualitatively new attacks, or mostly harden models against the current attack generator?
GPT-Red is a self-improvement loop aimed at safety rather than raw task performance. The model proposes attacks, observes a target system’s behavior, iterates, and supplies adversarial examples for training more robust production models.
OpenAI reports that GPT-Red succeeded in 84% of held-out indirect prompt-injection scenarios against GPT-5.1, compared with 13% for human red-teamers in the same internal mirror. It also transferred attacks from a simulation to a live autonomous vending-machine agent and found data-exfiltration attacks against a Codex agent.
Robustness result
Precursors to GPT-Red have been used in production-model training since GPT-5.3. OpenAI reports six times fewer failures for GPT-5.6 Sol than its best production model four months earlier on its hardest direct prompt-injection benchmark, with Sol failing on 0.05% of GPT-Red’s direct attacks across a broad internal set.
ASI relevance
This is a concrete example of using model capability to improve the next system’s safety. The unresolved issue is co-evolution: an attacker and defender can overfit to one another while remaining brittle to attacks outside the training game. Human and independent red teams remain necessary checks on the loop.