ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

prompt injection

OpenAI logo above red data streams attacking a blue AI network during GPT-Red prompt injection testing.

OpenAI Uses GPT-Red Attacks to Strengthen GPT-5.6

, , , , , , , , , ,

OpenAI says GPT-5.6 Sol had six times fewer failures on its hardest prompt-injection benchmark after training with attacks generated by GPT-Red.

 

OpenAI used GPT-Red prompt injection attacks to train GPT-5.6 to resist malicious instructions that could make an AI agent expose sensitive data or take actions a user did not approve.

Prompt injections can be hidden in outside content an AI agent reads, such as an email, webpage, or file. The agent may mistake the malicious text for a valid instruction and follow it instead of completing the user’s request safely.

OpenAI says GPT-5.6 Sol was more resilient to the company’s hardest direct prompt-injection attacks, failing one-sixth as often as the company’s best-performing model did four months earlier.

How GPT-Red helped strengthen GPT-5.6

OpenAI trained GPT-Red by having it attack a group of AI models that were simultaneously learning to resist its prompt injections. As those models became harder to fool, GPT-Red had to develop stronger and more varied attacks.

OpenAI then used the prompt injections GPT-Red created to train GPT-5.6. This exposed GPT-5.6 to more ways attackers might hide malicious instructions and trained it to ignore them while continuing the user’s task.

GPT-Red Exposed Sensitive Data in More Codex Agent Tests 

In another internal test, OpenAI used GPT-Red against a Codex coding agent powered by GPT-5.4 Mini.

The test included 10 previously unseen scenarios in which GPT-Red tried to make the agent expose sensitive data. OpenAI said GPT-Red succeeded in more scenarios and used fewer computing resources than a GPT-5.5 model prompted to perform the same task.

OpenAI plans to keep GPT-Red separate from the models it releases. The company said it will continue using automated testing alongside human and outside red-teamers as it develops future GPT models.

White OpenAI logo over a glowing red network of data lines, illustrating GPT-Red, OpenAI's automated red-teaming system

OpenAI Unveils GPT-Red to Test Future AI Models

, , , , , , , , , ,

The internal system automatically attacks OpenAI’s models to uncover vulnerabilities, and the company says it has already used GPT-Red to make GPT-5.6 more resistant to prompt injection attacks.

 

OpenAI introduced GPT-Red, an internal automated red-teaming system designed to attack the company’s own AI models and expose security weaknesses before release. The company said Wednesday that it already used GPT-Red to improve the security of GPT-5.6, its latest flagship model.

Red-teaming is a common method for stress-testing AI models for vulnerabilities before deployment. Previously, OpenAI relied on human experts and outside researchers to test new models, but the company says those methods are becoming difficult to scale as AI systems grow more capable.

According to OpenAI, GPT-Red works by repeatedly interacting with another model, observing its responses, and refining its attacks. The company trained the system using a form of self-play in which GPT-Red and a collection of defensive models competed against one another across a range of scenarios, including malicious instructions hidden in emails, web pages, local files, and software tools.

OpenAI said GPT-Red is highly effective at finding prompt-injection vulnerabilities, in which attackers embed malicious instructions in files or websites to make an AI system ignore its original rules. In one benchmark designed to measure prompt-injection attacks, GPT-Red succeeded in 84% of test cases, while human testers succeeded in 13%. 

OpenAI says GPT-Red is already influencing its production models. OpenAI used GPT-Red to help train GPT-5.6. The company says GPT-5.6 now performs much better on its toughest prompt-injection tests, failing six times less often than OpenAI’s strongest production model from four months ago. GPT-5.6 Sol fails on only 0.05% of GPT-Red’s direct prompt-injection attacks.

The company argues that automated testing will become increasingly important as AI systems improve. In its announcement, the company said human red-teaming remains essential but cannot generate enough attack scenarios to keep pace with more powerful models.

“We believe automated red-teaming unlocks a crucial form of self-improvement for safety: using today’s models to directly help make future models safer,” OpenAI wrote.

The company said it plans to continue expanding GPT-Red alongside human and third-party testing.

Robot icon above an AI search bar on a dark digital interface, illustrating AI as the top driver of data security decisions.

AI Becomes the Top Driver of Enterprise Data Security Decisions

, , , , , , , , , ,

Organizations now rank protecting AI systems and the data they use ahead of preventing traditional data leaks when choosing data security tools.

Key Takeaways

  • 64.4% of respondents said protecting the data used by AI systems is their top reason for evaluating data security tools, surpassing the prevention of the unauthorized removal of sensitive data (56%).
  • Better visibility into the data used by AI systems ranked as the most important capability in a data security posture management (DSPM) platform at 57.8%.
  • Respondents identified moving data to train AI systems as the leading reason sensitive information ends up in unauthorized locations (40.9%).
  • 76.4% of respondents expressed concern about prompt injection attacks targeting AI systems.

Enterprise security priorities are shifting as organizations expand their use of AI, according to the report Leveraging DSPM and Artificial Intelligence to Solve Data Security Challenges from Enterprise Management Associates (EMA). The research found that organizations now prioritize protecting AI systems over preventing traditional data leaks when choosing data security tools.

The report surveyed 225 IT professionals, security practitioners, data governance leaders, and technology executives across North American enterprises about their approaches to protecting sensitive data in AI-enabled environments. Much of the research focuses on DSPM: software that helps organizations discover, classify, and protect sensitive data across cloud and on-premises environments.

AI becomes the top security priority

The survey found that 64.4% of respondents ranked protecting the data used by AI systems, including prompts and training data, as their top priority when evaluating data security tools. That surpassed preventing traditional data leaks at 56%. According to EMA, it is the first time an AI-related priority has become the leading reason organizations evaluate such security tools.

The shift reflects the capabilities organizations value most. Better visibility into the data used by AI systems and the responses they generate ranked first at 57.8%. It finished ahead of more traditional capabilities such as automatically identifying sensitive data, tracking where data moves, and discovering where sensitive data is stored.

AI training creates new data security risks

The report found that AI is also changing how sensitive data moves through organizations. 40.9% of respondents identified moving data to train AI systems as the leading reason sensitive information ends up in unauthorized locations. That exceeded developer testing environments (25.8%) and backup or replication errors (16%).

AI threats continue to grow

Security leaders also reported growing concern about threats targeting AI systems. More than three-quarters of respondents expressed concern about prompt injection attacks targeting AI systems. In addition, 57.8% said emerging AI regulations are driving stronger AI governance efforts, placing them ahead of established compliance frameworks such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act.

Governance still trails AI adoption

While organizations are investing in security features designed for AI systems, governance has not advanced at the same pace. Only 37.3% of respondents said their organizations have a fully implemented AI governance framework, while 56.4% reported their frameworks are only partially implemented. Several other surveys fielded in 2026 report similar findings relating to this “governance gap.”