OpenAI's GPT-Red AI super-hacker boosts model defenses against cyberattacks

OpenAI's development of GPT-Red reflects a fundamental challenge in AI safety: as language models become more capable and are deployed in increasingly complex real-world scenarios—such as agents that interact with code, websites, and external systems—the scope of potential attacks grows faster than traditional human-led testing can handle. The company's co-creators, Nikhil Kandpal and Dylan Hunn, frame this as a problem of both expanding risk surface and growing blast radius. Rather than scaling up human red-teaming teams indefinitely, OpenAI designed GPT-Red using a self-play training loop, a technique in which an attacker model and defender models iteratively improve against each other. This approach mirrors competitive training dynamics seen in other domains and allows the system to discover novel attack vectors that might not have occurred to human testers.

The concrete results support the value of the method. When GPT-5.6 was tested against the strongest attacks GPT-Red discovered, fewer than 23% succeeded—a dramatic drop from more than 90% success against the earlier GPT-5 released in August last year. This measurable improvement in robustness across versions demonstrates that the red-teaming process yielded actionable defense improvements. Notably, GPT-Red uncovered attack types researchers had not previously encountered, including the fake chain of thought injection, which exploits the model's reasoning process itself rather than only its input handling. The discovery of such novel attacks underscores the value of automated red-teaming at scale.