GPT-Red: A Robustness Claim With No Outside Check

In July 2026, OpenAI published a technical paper on GPT-Red, an automated red-teaming agent trained through self-play reinforcement learning to find prompt-injection attacks against frontier language models. The company used it to adversarially train GPT-5.6, which the paper calls its most robust model to prompt injections to date. The results are genuine: GPT-Red finds more successful attacks than human red-teamers, and on the human-authored IPI 2025 Challenge benchmark, GPT-5.6 reached 100% robustness. None of that is in dispute, and none of it is this article's argument.

What the 28-page paper does not contain - across its methods, results, and acknowledgements - is any mention of an external, independent, or third-party organisation involved in designing, running, or checking any part of the evaluation behind that robustness claim. The attacker was built by OpenAI. The defender was trained by OpenAI. The scenarios were written by OpenAI. The grading was done by OpenAI. That is not a criticism of the research. It is a description of what the document says and does not say - and it is worth naming now, because "adversarial testing" is becoming a required line item in AI governance frameworks that also, separately, ask for something this paper does not describe.

What OpenAI actually published

GPT-Red is built on a self-play algorithm: an attacker model and a population of defender models train against each other simultaneously, with the attacker rewarded for eliciting failures and the defender rewarded for resisting them. OpenAI trained it at a compute scale the paper describes as comparable to its largest reinforcement-learning post-training runs - "the single-largest LLM safety training run ever documented," in the authors' own words. The scale shows in the results. Comparing GPT-5.6 against GPT-5.1, a model with substantial robustness training but without GPT-Red-sourced attack data, the paper reports the robustness metric on one hard evaluation category - "fake chain-of-thought attacks" - rising from 5.2% to 95.9%.

The paper is also candid about its limits. Its own conclusion states that GPT-Red "has seen less training on multi-modal environments, multi-turn attack scenarios, and content-policy jailbreaks," with broader coverage planned. That kind of self-disclosed limitation is a good sign for a technical paper. It is a different thing from external verification, and the paper never claims to offer the latter.

The chapter most coverage has not read

The EU AI Act's General-Purpose AI Code of Practice sets out, in its Safety and Security chapter, what providers of the most capable general-purpose AI models are expected to do to manage systemic risk. Measure 3.2 requires signatories to conduct model evaluations - explicitly naming "red-teaming and other methods of adversarial testing" - designed to identify "unexpected behaviours, capability boundaries, or emergent properties." GPT-Red is, on its face, exactly this kind of exercise, done well and at real scale.

The same chapter does not stop there. Under Measure 3.5, signatories must separately "provide an adequate number of independent external evaluators with adequate free access" to specified versions of their models, so that post-market monitoring can happen outside the lab that built the system. The Code treats these as two distinct obligations, not one restated twice - internal adversarial testing is Measure 3.2; independent external access is Measure 3.5. A lab can satisfy the first in full and say nothing at all about the second, and a reader moving quickly through a technical paper full of self-play training curves and attack-success charts could easily read "we red-teamed it exhaustively" as covering ground that, structurally, it does not.

This is this article's reading of what the paper's silence means, not something OpenAI has stated about the Code of Practice or its own compliance posture - whether OpenAI is a signatory is not established here, and the point being made does not depend on that either way. The observation stands on the document alone: a flagship robustness claim, built entirely in-house, published without any indication that anyone outside the organisation touched the evaluation loop behind it.

Why this is easy to miss

The reason this gap is not obvious is that automated self-play red-teaming looks, on the page, like exactly the rigour a sceptical reader would want. GPT-Red is not a rubber stamp - it is an adversarial system explicitly built to break its own organisation's models, trained at unprecedented scale, and it succeeds against attacks a human red-teamer would not find. That is real engineering, and it is a meaningfully higher bar than the ad hoc internal reviews that "adversarial testing" often meant a few years ago.

But rigour and independence are different properties, and a paper can demonstrate one without saying anything about the other. An organisation reading GPT-Red's results and treating them as a substitute for external verification is not misreading the paper's numbers - it is filling in a claim the paper never makes. Nothing here suggests OpenAI intends that reading; the paper's authors are describing an internal safety-training method, not writing a compliance filing. The risk sits with the reader, not the paper - and it grows precisely because the paper is technically impressive enough that the question "who else looked at this?" is easy not to ask.

What changes depending on where an organisation sits

For a frontier lab building its own foundation models, GPT-Red's approach is directly actionable: self-play adversarial training at scale is now a demonstrated method for hardening a production model against prompt injection, and the paper's own methodology section is detailed enough to inform how a comparable programme might be built. The open question for that lab is not whether internal red-teaming works - this paper shows it can - but whether internal red-teaming, however rigorous, is being presented anywhere as if it answers the external-verification question too.

For an organisation deploying someone else's model rather than building one, the practical takeaway is narrower but sharper: a vendor's or partner's published safety-training results, however detailed and however impressive the metrics, describe what that organisation found when it tested itself. They do not, by themselves, answer whether an independent party has had access to check the same claims. Those are different questions, and a procurement or risk-assessment process that treats a strong internal red-teaming paper as equivalent to third-party evaluation is answering the wrong one.

What a well-run AI operation does differently

A well-run AI operation reads a paper like this one for what it actually demonstrates - a serious, technically credible internal safety investment - without inferring an external-verification claim that is not there. It asks the follow-up question explicitly, in writing, rather than assuming a detailed methods section has already answered it: has this specific model, or this specific evaluation, had any independent party's hands on it, under the Code of Practice's Measure 3.5 or an equivalent arrangement? And it treats "we tested it ourselves, extensively" and "someone outside checked it" as two separate boxes on a checklist, not one, because the GPAI Code of Practice already draws exactly that line - in a chapter most of the coverage of GPT-Red so far has not mentioned.

Source note. The paper "GPT-Red: Automated Red Teaming via Self-Play at Scale" is published by OpenAI at cdn.openai.com. The EU AI Act's General-Purpose AI Code of Practice, Safety and Security chapter, is published by the European Commission at ec.europa.eu.