On July 15, 2026, OpenAI published research on GPT-Red, an automated red-teaming model built to find weaknesses in other models. The problem is concrete: when an AI system reads third-party data through a browser, connected app, local file, or code repository, a malicious instruction can enter the tool output and persuade the system to leak data or take an unsafe action.
OpenAI says human red-teaming remains essential, but designing and running exercises takes time and makes it difficult to generate enough diverse adversarial examples. GPT-Red is meant to expand repeatable attack discovery, not replace human testing, so teams can identify new failure modes faster before deployment.
GPT-Red is trained with self-play reinforcement learning. The model and a collection of defender LLMs participate in red-teaming scenarios: GPT-Red is rewarded for eliciting a valid failure, while defenders are rewarded for resisting the attack and completing their original task. As the defenders improve, the attacker has to find stronger and more varied strategies.
The model works like a human red teamer by sending a prompt, observing the response from GPT models, and iterating. OpenAI says GPT-Red was trained at the compute scale of some of its largest post-training runs and is incorporated into production-model training. According to OpenAI's report, GPT-5.6 Sol had six times fewer failures on its hardest direct prompt-injection benchmark than the best production model from four months earlier.
The scenarios include internal-directory exfiltration, fraudulent payment instructions, AWS credential exfiltration, disabling two-step verification, credential-file uploads, external script injection, API-key forwarding, and malicious build scripts. The examples show why prompt injection is not limited to chat: any tool that places external content in an agent's context can become part of the attack surface.
For deployment teams, the practical signal is to make security testing part of the workflow rather than a one-off scan before launch. Teams can define a threat model for each tool, record what an attacker can control and what counts as a successful attack, then combine automated red-teaming with human and third-party testing, layered safeguards, and real-time monitoring.
This is still OpenAI's report on its own method and results, so it should not be treated as a guarantee for every agent environment. A reliable security baseline needs to be reproduced against the organization's own tools, permissions, data, and operating processes, with human approval preserved for high-risk actions.
