OpenAI Secretly Trains "AI Super Hacker" GPT-Red, Achieving 84% Attack Success Rate ...

The battle for AI security is entering a new phase: using AI to attack AI, thereby making AI safer. OpenAI recently disclosed that it has trained a new AI model, GPT-Red, specifically designed to attack its own large language models. In internal testing, this "AI red team member" achieved an 84% success rate on prompt injection attacks, compared to just 13% for human red team members.

GPT-Red is not an assistant for ordinary users; it is purely a "sparring partner" and "attacker." Its sole mission is to continuously find vulnerabilities in OpenAI's other models—particularly its latest flagship, GPT-5.6—and launch attacks, forcing the defending models to learn and evolve through adversarial training, ultimately becoming more robust. "The attack surface is expanding, and the potential blast radius is expanding," noted Nikhil Kandpal, an OpenAI research scientist and co-developer of GPT-Red.

The core operating mechanism of this system is self-play reinforcement learning . Researchers took a base large language model with no prior hacking-related training and placed it in a simulated real-world environment—including typical work scenarios such as browsing the web, processing emails, managing calendars, and editing code. GPT-Red's goal is to continuously find and optimize attack methods, while multiple defense models attempt to resist these attacks. Through round after round of confrontation, the attacker's capabilities steadily improve, and the defenders gradually learn to identify and neutralize new attack vectors.

Dylan Hunn, another co-developer and OpenAI research scientist, explained the unique advantage of AI over human red teams: "Compared to human red teams, the model is particularly good at judging what methods actually work and which attacks have the highest success rate. Once it finds a viable attack, it will persistently explore deeper, continuously optimizing that attack method."

During the research process, GPT-Red discovered a novel attack method that surprised the team, which researchers named "fake chain of thought." Chain of thought is the internal working record where large language models document intermediate reasoning steps. GPT-Red found a way to insert fabricated information into another model's chain of thought, making the model believe this was a reasoning result it had previously verified itself, and continue executing subsequent tasks based on that false premise. Chris Choquette-Choo, an OpenAI scientist involved in the research, used a simple analogy: "It's like someone telling you, '1+1=3, and this is a result you've already verified yourself.' The model thinks: 'Since I've already confirmed this, it must be fine.' And then it just outputs 3."

To objectively evaluate GPT-Red's attack capabilities, OpenAI re-ran a 2025 experiment where human red teams had attempted to find vulnerabilities in an early version of GPT-5. In this comparative test, GPT-Red found more effective attack methods than the human team. Additionally, the research team used GPT-Red to test Vendy, a vending machine agent developed by Andon Labs. During testing, GPT-Red successfully induced Vendy to modify product prices and cancel a user's order.

The effectiveness of these attack methods varied significantly across different model versions. The research team applied some of the most effective attacks discovered by GPT-Red to models from different generations, revealing a clear security gap between versions.

Jessica Ji, a senior research analyst at Georgetown University's Center for Security and Emerging Technology (CSET), praised OpenAI's self-play training approach: "The results we're seeing so far are promising." However, she emphasized: "Human experts remain very important. Being able to further clarify which tests most require human involvement would be extremely valuable."

GPT-Red is not a panacea. Researchers acknowledge that it is currently not adept at handling complex attacks requiring sustained multi-turn interactions between attacker and target—an area that remains a traditional strength of human attackers. Furthermore, the model's ability to execute prompt injection attacks using images also needs improvement. For these reasons, OpenAI does not view GPT-Red as a replacement for human red teams, but rather as a powerful assistive tool. One current approach used by the company is to have human researchers design new attack concepts, then let GPT-Red automatically generate various permutations, exponentially expanding test coverage.

OpenAI has made it clear that it will not release GPT-Red publicly. The company believes that even if other institutions understood the technical approach, replicating an attack model of equivalent caliber would be extremely difficult. GPT-Red has been continuously trained for over a year, backed by the massive computational resources OpenAI has invested in over the long term. Choquette-Choo stated bluntly: "This is not a system that can be easily reproduced just by knowing the design concept. Training a high-level attack model like this is not a simple task."

It is worth noting that the idea of using AI to protect AI infrastructure is not unique to OpenAI. Earlier in July 2026, the Ethereum Foundation also deployed AI agents to audit its critical network infrastructure, successfully discovering a vulnerability in the software used by its consensus client. This trend indicates that, from AI labs to the blockchain space, using automated AI systems for security defense is becoming a new industry consensus.

OpenAI views GPT-Red as the starting point of a virtuous cycle in the security domain. The company stated: "We believe that with GPT-Red, we have begun to unlock a similar cascading effect: today's models serve to make tomorrow's models more robust, more aligned, and more trustworthy." As AI agents begin to access files, browse the web, call third-party code, and even collaborate with other agents, relying entirely on manual testing is becoming increasingly insufficient to cover all potential attack paths. The emergence of GPT-Red marks a critical step in the transformation of AI security defense from labor-intensive methods to automated, intelligent systems.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.