# OpenAI’s GPT-Red Finds Attacks in 84% of Indirect Prompt-Injection Scenarios

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/24463
Published: 2026-09-26T18:36:19.000Z
Updated: 2026-09-26T18:36:19.000Z
Section: Technology

> The system outperformed human red-teamers in indirect prompt-injection evaluations, while separate research showed how malicious prompts could spread between simulated AI email assistants.

OpenAI’s GPT-Red disclosure says its models can be vulnerable to sophisticated prompt-injection attacks, a security risk that can influence systems through ordinary digital content and connected tools.

GPT-Red is an automated red-teaming model designed to find weaknesses and improve defenses. It was trained through self-play reinforcement learning against defender models and rewarded for producing valid failures, including successful prompt injections.

The system succeeded in 84% of scenarios in an indirect prompt-injection evaluation, compared with 13% for human red-teamers. Potential delivery channels include emails, webpages, local files, tool responses and code repositories.

Prompt injection occurs when malicious instructions hidden in third-party content change an AI system’s behavior. GPT-Red remains separate from deployed models, and attacks generated by the system are used to train production models to resist similar failures.

In one test, GPT-Red achieved three malicious objectives against an AI-powered vending-machine agent. It reduced an item’s price to $0.50, ordered an item priced above $100 and offered it for $0.50, and canceled another customer’s order.

The results also showed improvements in newer models. GPT-5.6 Sol had six times fewer failures on its hardest direct prompt-injection benchmark than the best production model four months earlier. An early “Fake Chain-of-Thought” attack succeeded against more than 95% of GPT-5.1 tests but less than 10% of GPT-5.6 Sol tests. In the latest evaluation, GPT-5.6 Sol failed on 0.05% of GPT-Red’s direct prompt injections.

Separate Morris-II research described a self-replicating prompt that could propagate between simulated AI email assistants. The study used retrieval-augmented-generation systems in a simulated environment, where one assistant could be instructed to reproduce a malicious instruction in its output and pass it to another assistant.

The research demonstrates a mechanism in a simulated environment; it does not establish a real-world attack against OpenAI’s systems. The disclosure and research do not confirm that an OpenAI production system was infected by a self-replicating prompt.

The Morris-II study tested a Virtual Donkey defense, which recorded a true-positive rate of 1.0 and a false-positive rate of 0.015. Defending against prompt injection remains an industrywide challenge and a central focus at OpenAI.