OpenAI、自動攻撃AI「GPT-Red」発表 人間13％に対し84％成功

OpenAI's announcement of GPT-Red reflects a shift in how AI companies approach safety validation. Traditional red-teaming by human experts is labor-intensive and cannot generate the volume and variety of attack data needed to significantly improve model robustness. By automating this process with an AI opponent trained via self-play, OpenAI aims to create what it calls a "safety flywheel"—a cycle where today's models train tomorrow's models to be more resilient. The company invested computation resources equivalent to its largest post-training efforts solely into safety, underscoring the resource commitment required.

The real-world test on an AI vending machine agent in OpenAI offices demonstrated the practical stakes: GPT-Red successfully achieved three malicious goals (price manipulation, order fraud, and order cancellation) that previous defenses had not caught. This discovery then fed back into training GPT-5.6 Sol, which now exhibits dramatically lower failure rates on prompt injection benchmarks. The company emphasizes that this robustness gain came without degrading model capability—a critical distinction, since overly defensive models often become less useful. By keeping GPT-Red internal and planning to publish a peer-reviewed paper, OpenAI is attempting to balance transparency with security, allowing the research community to learn from the work while preventing attack tools from proliferating.