The office vending agent is called Vendy. OpenAI says its internal red-team model, GPT‑Red, rehearsed attacks in simulation, then transferred them to the live machine and hit three goals: drop an expensive in-stock item to the floor price of $0.50; order a new $100+ item and price it at $0.50; and cancel another customer’s order. The bugs were disclosed; new safeguards are still being tested.
This is not another “we take safety seriously” note. In the GPT‑Red research post around 2026-09-03, OpenAI nails the story to a pipeline labs rarely show in public detail: train a specialist attacker, then use it during training to harden the next production model. GPT‑5.6 Sol is framed as their most prompt-injection-robust release yet—about 6× fewer failures on their hardest direct prompt-injection benchmark versus the best production model from four months earlier.
[1]What it is actually attacking
The official facts are blunt. Browsers, connected apps, local files, and tool replies all pour third-party text into a model’s context. An email, a webpage banner, a tool response, or a repo can hide a prompt injection that steers the model into shipping sensitive data outbound.
Human red teams find cases; they do not mint training-scale adversarial data. OpenAI’s answer is GPT‑Red—an internal-only automated red-teamer that sets a goal, sends a prompt, watches the GPT response, and iterates. Training compute is described at the scale of some of OpenAI’s largest post-training runs: an unprecedented budget dedicated purely to safety, in their telling.
The recipe is self-play RL. GPT‑Red and a diverse pool of defender LLMs train together. The attacker scores for eliciting a valid failure (a successful injection); defenders score for resisting while finishing the original task. As defenders harden, the attacker is forced into stronger, more diverse attacks. Environments come with explicit threat models: what the attacker can touch (file fragment, banner, email body, tool output) and what counts as success.
By the end of training, OpenAI says GPT‑Red breaks nearly every model it faces—internal and production, up through GPT‑5.5. Those attacks then seed GPT‑5.6 training until the production model resists GPT‑Red’s own repertoire. One hard rule: GPT‑Red is not shipped. Malicious skill stays inside; robustness is what leaves the building.
[1]Hardness you can quote
On a replicated Dziemian et al. (2025) indirect prompt-injection arena (internal mirror; goals distinct from training), against GPT‑5.1: humans succeeded on about 13% of scenarios; GPT‑Red on about 84%.
On ten held-out data-exfiltration scenarios against a Codex CLI agent (GPT‑5.4 mini), OpenAI says GPT‑Red beat a prompted GPT‑5.5 baseline on both success and token efficiency.
Over six months, stronger red-team precursors were written into successive production trains since GPT‑5.3. One example: “Fake Chain-of-Thought” direct injections hit 95%+ success on GPT‑5.1 and fall below 10% on GPT‑5.6 Sol. Several indirect-injection benchmarks aimed at developer tools and browsing are reported >97% accurate on the latest model. Across a broad robustness suite, GPT‑5.6 Sol fails on only 0.05% of GPT‑Red’s direct prompt injections.
OpenAI stresses the gains are not “refuse more, do less.” Frontier capability checks plus targeted over-refusal tasks supposedly stay intact—resistance to malicious instructions, not a quieter product.
[1]What the industry is being sold
The capability flywheel—“today’s models make tomorrow’s models stronger”—is old copy. GPT‑Red sells the mirror image: a safety self-improvement flywheel, where today’s attacker is welded into training so tomorrow’s model is harder to break.
Set beside Anthropic-style stories about Claude-as-alignment-researcher and monitors catching cheats, this post reads more like an engineering ledger: compute budget, self-play, red-team outputs fused into post-training, then spot-checks on a vending agent and Codex CLI. The fights worth having are concrete:
- Opacity: 84%, 6×, 0.05%, Fake-CoT curves all live on in-house benches and internal mirrors.
- Closed attacker: keeps abuse tools offline; also blocks independent reproduction of “how strong is the red team?”
- Scenario bias: even “realistic” training rooms miss messy enterprise auth graphs and supply-chain edges.
- Coupled to the capability race: matching red-team compute to top post-training admits safety spend must scale with capability spend—or the flywheel stalls first.
My read: remember this less as “another safer model” and more as prompt injection turned into a scalable adversarial-training workcell. The half-dollar vending machine is just the receipt that spilled into the physical office. Buyers should ask whether red-team compute stays peer to flagship training, whether ASR curves against the internal attacker stay public, and whether third-party red teams still get an independent door.
Source: GPT‑Red: Unlocking Self-Improvement for Robustness. Commentary on a public research post; not a security audit.
[1]