OpenAI is now using AI to attack its own AI, and it's working better than humans ever did

2026-07-15 · Source: The Decoder · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Advanced, quick

Summary

OpenAI has developed an internal AI model named GPT-Red to automatically identify security vulnerabilities, particularly prompt injections, in its own GPT models. Utilizing self-play reinforcement learning, GPT-Red simulates attacks while defender models learn to block them, leading to mutual improvement. This AI red teamer demonstrates an 84 percent success rate in finding attacks in test scenarios, significantly outperforming human red teamers who achieve only 13 percent. For instance, GPT-Red successfully manipulated an AI-powered vending machine in OpenAI's office, altering prices and canceling orders. The insights gained from GPT-Red are directly integrated into model training, resulting in GPT-5.6 Sol exhibiting six times fewer failures on direct prompt injections compared to models from four months ago, without compromising general performance. Despite these advancements, approximately 3.8 percent of "stronger" prompt injections still manage to succeed. GPT-Red remains an internal tool, with a detailed paper expected to be released later.

Key takeaway

For AI Security Engineers focused on large language model robustness, this development suggests traditional human red teaming is insufficient. You should explore integrating AI-powered adversarial testing tools, like the described GPT-Red approach, into your security pipelines. Relying solely on human efforts leaves significant vulnerabilities unaddressed. AI red teamers demonstrate superior efficacy in uncovering complex prompt injections and other attack vectors. Consider piloting AI-driven security assessments to proactively strengthen your models against evolving threats.

Key insights

OpenAI's GPT-Red, an AI red teamer, significantly outperforms humans in finding prompt injection vulnerabilities through self-play reinforcement learning.

Principles

• AI-driven red teaming surpasses human efficacy.
• Self-play reinforcement learning enhances model robustness.
• Continuous adversarial testing improves security.

Method

GPT-Red uses self-play reinforcement learning to simulate prompt injections and other attacks. It attacks while defender models block, iteratively improving both sides.

In practice

• Deploy AI red teamers for LLM security.
• Apply self-play to enhance model resilience.
• Continuously test for prompt injection vulnerabilities.

Topics

• AI Red Teaming
• Prompt Injection
• Large Language Models
• AI Security
• Reinforcement Learning
• GPT-Red

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Security Engineer, AI Scientist, Machine Learning Engineer

Related on AIssential

• Meet GPT-Red: an LLM super-hacker OpenAI built to make its models safer — OpenAI's GPT-Red, an LLM super-hacker, automates red-teaming through self-play to significantly improve LLM defenses against novel cyberattacks like prompt injection.
• This AI Startup’s Army Of 15,000 Hackers Pressure Test Claude, GPT-5 And Gemini - Forbes — Human red-teaming data is crucial for training AI agents to proactively identify and mitigate complex AI system vulnerabilities.
• Continuously hardening ChatGPT Atlas against prompt injection — Automated red teaming with reinforcement learning proactively hardens AI agents against prompt injection attacks.
• OpenAI and Anthropic this week: GPT-Red, Fable 5 plan changes, and free Claude for teachers (Week… — Leading AI labs are rapidly advancing model capabilities, safety, and accessibility across diverse applications.
• Previewing GPT-5.6 Sol: a next-generation model — OpenAI's GPT-5.6 series enhances AI capabilities across domains while integrating a multi-layered safety framework and new reasoning modes.
• Red-Teaming after Mythos — Zico Kolter & Matt Fredrikson, Gray Swan — AI security is distinct from cybersecurity, requiring specialized tools and a different mindset to counter agent vulnerabilities and prompt injection.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by The Decoder.