# GPT-Red Makes GPT-5.6 Sol 6x Harder to Jailbreak

GPT-Red achieved 84% attack success vs human red-teamers' 13%, and adversarially training GPT-5.6 Sol against it made the model 6x more robust to jailbreaks.

By Neomanex. Updated 2026-10-07.

OpenAI disclosed GPT-Red on July 15, 2026 — the first dedicated automated safety red-teaming model trained at frontier-training compute scale and deployed in a production model pipeline. **[GPT-5.6 Sol](/models/gpt-5-6-sol) stays Recommended.** This safety-hardening disclosure strengthens the existing stance: the model behind Sol's frontier benchmark performance was adversarially trained against a red-teamer that achieved an 84% attack success rate against the previous generation.

## What GPT-Red is and what it found

GPT-Red is trained via self-play reinforcement learning: the model attacks a population of diverse defender LLMs, and both sides improve through the adversarial dynamic. GPT-Red is rewarded for finding valid failures — successful prompt injections — while defenders are rewarded for resisting and completing their original tasks. As defenders get stronger, GPT-Red is forced to discover harder attacks. It's a flywheel that scales safety alongside capability.
The numbers back up the architecture:

| Metric | GPT-Red Result | Baseline |
|---|---|---|
| Attack success on GPT-5.1 (indirect prompt injection) | 84% | 13% (human red-teamers) |
| GPT-5.6 Sol prompt-injection failure reduction | 6x fewer | Best prior production model (4 months earlier) |
| Real-world test (AI vending machine) | All 3 objectives achieved | — |

GPT-Red is not a product. It's an internal training tool — a model you'll never interact with directly, but one whose output (harder adversarial training) you benefit from every time you use GPT-5.6 Sol.

## Why it matters

This disclosure matters for three reasons:

**1. It sets a new bar for safety transparency at the frontier.** OpenAI named the model, described the self-play RL architecture, published attack and defense numbers, and included a real-world test — all in a single system card-adjacent release. Most frontier labs disclose safety metrics aggregated across unnamed tools. GPT-Red is a named, architected system with measurable performance.

**2. It closes a competitive gap on paper trail.** OpenAI's GPT-5.6 Sol preview disclosed over 700,000 A100-equivalent GPU hours of automated red-teaming. GPT-Red is the model behind those numbers. Disclosing it turns an opaque safety metric into an auditable safety investment — you now know what those GPU hours bought.

**3. The architecture scales with capability.** Human red-teaming doesn't scale linearly with model intelligence — the creativity bottleneck is real. Self-play RL does scale: as defenders get smarter, the attacker generates harder attacks adversarially rather than relying on human ingenuity. For frontier models, this is the right safety architecture.

## What changes for you

Nothing about the **[GPT-5.6 Sol](/models/gpt-5-6-sol)** verdict. It was Recommended before GPT-Red, and it stays Recommended — but the disclosure strengthens the rationale. The model was trained against an attacker 6.5x more effective than human red-teamers and came out 6x more robust than its predecessor. Safety investment at the same scale as capability investment is exactly what you want to see behind a Recommended rating.

For teams evaluating frontier models for deployment: GPT-Red is a signal that OpenAI's safety infrastructure is getting the same frontier-scale compute as the models themselves. Factor it into your security posture assessment alongside Sol's benchmark strength — but don't expect it to change your model choice. It reinforces an existing verdict rather than creating a new one.

### FAQ

**Can I use GPT-Red?** No. GPT-Red is an internal training tool — it exists solely to attack and harden OpenAI's production models during development. You cannot access it, and you wouldn't want to.

**Does this change GPT-5.6 Sol's safety posture?** It confirms what the system card already implied: Sol was adversarially trained at scale. The disclosure makes that training measurable rather than asserted. Sol was already hardened; GPT-Red is the explanation of how.

**How does this compare to what other labs disclose?** Most frontier labs publish aggregated safety metrics without naming or architecting the tools behind them. GPT-Red is the first named, architected safety-red-teaming model disclosed with a dedicated system card-level post in a production frontier pipeline. That level of transparency is worth noting — it's the direction all labs should move.

Canonical: https://neomanex.com/news/gpt-red-safety-model