OpenAI、AIで防御を鍛える攻撃モデル「GPT-Red」開発

OpenAI's development of GPT-Red reflects a fundamental shift in AI safety testing as large language models become more capable and widely deployed. Traditionally, red-teaming—the practice of finding security vulnerabilities before release—has relied on human testers, but the growing complexity of LLMs and their integration with external systems like web browsers, code editors, and other AI agents has made comprehensive human-only testing increasingly difficult. The self-play loop approach OpenAI employed, in which GPT-Red iteratively attacks other models while they defend themselves, creates a training ground where both attacker and defender capabilities co-evolve. This mirrors competitive dynamics in cybersecurity, where defenders must anticipate and prepare for attacks that haven't yet been invented.

The "Fake Chain of Thought" attack exemplifies why automation may be necessary: it exploits a mechanism (chain-of-thought reasoning) that is internal to how modern LLMs solve problems, and discovering such attacks requires understanding the model's own logic. When OpenAI replicated a 2025 experiment in which human red teamers had found vulnerabilities in GPT-5, GPT-Red outperformed the human testers, suggesting that automated searching of the attack space can be more thorough in specific domains. However, the body makes clear that GPT-Red is not intended to replace human expertise—human testers can still find attacks GPT-Red misses, and vice versa, so the most effective approach combines both.