OpenAI deploys GPT-Red, an AI system that attacks itself to find security weaknesses

As AI agents move beyond text generation into performing live tasks, manual security testing has become a bottleneck. OpenAI this week introduced GPT-Red, an automated red-teaming system that uses one AI model to relentlessly attack another, identifying prompt injection vulnerabilities that human researchers would take far longer to discover individually.

The challenge is urgent: traditional security audits conducted before launch no longer suffice for systems that actively parse untrusted emails, read PDFs, and browse the web. Every external input becomes a potential attack surface.

How self-play adversarial training works#

GPT-Red operates through self-play reinforcement learning, pitting an attacker model against defender models in a continuous cycle. The attacker earns rewards for triggering failures—particularly prompt injections—while defenders gain rewards for completing tasks safely. OpenAI constructed simulated environments mirroring real-world exposure surfaces: emails, local files, API responses, and other untrusted external data that agentic systems increasingly depend on.

This approach allows GPT-Red to brute-force thousands of exploit variations in seconds, mapping the precise boundaries of each vulnerability rather than discovering them piecemeal.

Real-world testing reveals scope#

OpenAI tested GPT-Red not just against benchmarks but against live production systems. One target was an AI-powered vending machine from Andon Labs; after training in simulation, GPT-Red manipulated the production agent into slashing prices on items costing over $100 down to 50 cents, made a purchase at that rate, and canceled another customer's order.

In a separate evaluation, GPT-Red probed a Codex CLI agent running GPT-5.4 Mini for data exfiltration vulnerabilities. The specialized attacker discovered more successful exploit paths than a general-purpose GPT-5.5 baseline while consuming fewer tokens—suggesting that purpose-built offensive models outperform frontier models at security testing.

Significant resilience gains without overreach#

GPT-Red's findings were then incorporated into GPT-5.6's training, yielding a sixfold reduction in failures on one of the most difficult direct prompt-injection benchmarks compared to the strongest production model released four months earlier. On broader adversarial evaluation, GPT-5.6 Sol failed only in 0.05% of direct prompt-injection attempts.