On July 15 OpenAI released GPT-Red — an internal model trained specifically for automated red-teaming. It is not released or open-sourced, but the GPT-5.6 Sol trained with it has a failure rate on the hardest direct-prompt-injection benchmarks that is 6x lower than the best production model from four months ago, and in some scenarios is pushed down to 0.05%. GPT-Red's core training method is self-play: the attacker model and a set of "defender LLMs" train adversarially across multiple real deployment scenarios. The attacker is rewarded whenever it succeeds at prompt injection; the defender is rewarded whenever it holds the original task. As the defenders get stronger, the attacker is forced to discover more devious attack paths. OpenAI places scenarios such as the browser, email, calendar, code editor, and local file system into a "training dojo", each with a clear threat model. The most interesting discovery GPT-Red made is the "fake chain-of-thought" attack: it inserts forged entries into another model's chain-of-thought log to make it believe a fact has already been self-verified. This attack had a >95% success rate on GPT-5.1, and is pushed below 10% on GPT-5.6 Sol. On generalization, GPT-Red achieves 84% attack success against GPT-5.1 on Dziemian et al.'s 2025 indirect-prompt-injection reproduction benchmark — human red-teamers only 13%. On Andon Labs' Vendy vending-machine agent, GPT-Red completed three malicious objectives: changing high-priced items to $0.50, ordering $100+ items and reselling at $0.50, and cancelling others' orders. More importantly, GPT-5.6's general capability is unaffected — the robustness gain wasn't bought by "rejecting more requests". If the self-play red-team paradigm spreads among frontier vendors, the safety-evaluation methods of the next 12–18 months may be rewritten — human red-teamers will degrade from "main force" to "long-tail supplement". But open questions follow: as attacker and defender models scale together, who first hits a physical or cognitive ceiling?