OpenAI's GPT-Red uses self-play to break its own models

If you gave an AI agent the keys to your office vending machine, how long would it take to get manipulated? If it's facing OpenAI's new internal hacking model, the answer is: not very long at all.

OpenAI just unveiled GPT-Red, an automated safety red-teaming model trained with self-play reinforcement learning to hunt down and exploit vulnerabilities. Instead of relying purely on humans to dream up adversarial jailbreaks, OpenAI is now pitting an automated attacker against its own systems to build stronger armor before models ever see the light of day.

This adversarial training has already made its way into production. OpenAI reports that its new flagship, GPT-5.6 Sol, suffers 6x fewer failures on its hardest direct prompt injection benchmark compared to its top model from four months prior. Against GPT-Red's own direct attacks, the failure rate is down to an impressive 0.05%.

Training AI to hack AI

Human red-teamers are great at creative exploits, but human hours don't scale. They can't generate the massive volume and diversity of adversarial data needed to truly train a model into resilience.

To break that bottleneck, OpenAI spent an unprecedented amount of compute on safety post-training. GPT-Red was trained in a self-play environment against a population of defender models across diverse scenarios. If GPT-Red pulled off an injection, it was rewarded. If the defenders stood their ground and finished the task, they got the reward. As defenders hardened, GPT-Red was forced to evolve far more creative attacks.

The results in unseen territory were staggering. In a replicated indirect prompt injection challenge, human experts achieved a 13% attack success rate against GPT-5.1. GPT-Red, facing scenarios it was never trained on, hit an 84% success rate.

Earlier variations of GPT-Red even invented novel attack vectors like Fake Chain-of-Thought injections, which originally fooled GPT-5.1 over 95% of the time. In GPT-5.6 Sol, that failure rate has plummeted under 10%.

50-cent snacks and broken vending machines

To see how this works in real life, OpenAI turned GPT-Red loose on an AI-powered smart vending machine in its own office, built by Andon Labs.

With only a general description of the system and trial interactions in a sandbox, GPT-Red figured out how to subvert the real production agent. It successfully hit all three of its assigned malicious goals: changing an expensive in-stock snack to the minimum price of 50 cents, ordering a brand-new $100+ item and offering it for 50 cents, and canceling another customer's pending order.

Critically, OpenAI says the resulting defense isn't just a lobotomized model that refuses every prompt. Evaluations showed that GPT-5.6 Sol retained all its frontier capabilities without a spike in unwarranted refusals. The model learned what malicious intent looks like, rather than just becoming afraid of its own shadow.

Why it matters

We think this work marks a pivotal shift in AI safety from artisan craft to industrial flywheel. Up until now, safety has lagged behind raw model capabilities because finding exploits required manual labor. By demonstrating that self-play reinforcement learning works for safety just as well as it does for games or reasoning, OpenAI has found a way to let safety scale directly with compute.

However, the strategy comes with a massive catch. OpenAI is keeping GPT-Red locked tightly inside its walls for good reason: an AI that out-thinks human hackers 84% to 13% on novel targets is essentially an automated cyberweapon. While OpenAI keeps it separate, the underlying research blueprint is now public, and it won't be long before adversaries train their own offensive models using identical self-play recipes.

For businesses deploying agents into production, the office vending machine test is the real headline. As soon as models are hooked up to APIs, tool execution, and real wallets, prompt injection ceases to be a theoretical chatbot issue and becomes an immediate operational risk. Hardening production agents against automated exploits is no longer optional—it's about to become the entire game.