Today OpenAI introduced GPT-Red, an internal model purpose-built to break other AI models. It doesn't just find the attacks humans find, faster. It finds attacks humans can't find — and it's 6x better at it.

The headline numbers are startling enough that I want to get them on the table immediately:

Red Teamer	Attack Success Rate
Human red-teamers	13%
GPT-Red	84%

That's not incremental. That's a regime change.

Here's why this matters: AI security has been stuck in a bottleneck. Human red-teamers are expensive, slow, and — as these numbers show — fundamentally limited in how many attack surfaces they can explore. A single adversarial human might spend days crafting one elegant jailbreak. GPT-Red explores thousands of variants, finds novel attack categories humans never thought of, and does it all in the time it takes you to read this sentence.

What Is GPT-Red, Exactly?

GPT-Red is an LLM trained specifically to attack other LLMs. It's built on a self-play reinforcement learning loop, which is the key innovation here:

GPT-Red (the attacker) sends prompts to a collection of Defender LLMs
The Defender tries to stay on task despite the attack
GPT-Red gets rewarded for eliciting a failure (a successful prompt injection)
The Defender gets rewarded for resisting while completing its original task
As Defenders improve, GPT-Red must discover harder, more diverse attacks

This is the same structural dynamic that made AlphaGo superhuman — adversarial self-play forces both sides to the frontier of what's possible. And OpenAI has been running this loop internally since GPT-5.3, meaning each successive GPT release has gotten monotonically more robust against automated attack.

"Compared to a human red-teamer, the model is very, very good at finding exactly what will work, exactly what's most effective. It's extremely persistent about drilling down into an attack that it has discovered." — Dylan Hunn, OpenAI research scientist (via MIT Technology Review)

The Attack That Humans Never Found

GPT-Red discovered a novel vulnerability category that researchers had never documented: Fake Chain-of-Thought attacks.

Here's the shape of it: GPT-Red inserts a fabricated entry into a model's internal reasoning trace — its chain-of-thought scratchpad — that presents a false premise as already-verified fact. The model, trusting its own reasoning process, follows it without question.

"It's like if I told you that 1+1=3 and that you have verified this already… The model's like, 'Oh, okay, of course,' and it just spits out 3." — Chris Choquette-Choo, OpenAI research scientist

Before GPT-Red, this attack surface didn't exist in the literature. An AI discovered a whole new category of AI vulnerability by exploring the search space more thoroughly than any human could.

On GPT-5.1, Fake Chain-of-Thought attacks succeeded >95% of the time. On GPT-5.6 Sol — which was trained directly against GPT-Red — that dropped to <10%.

What Happens When You Let GPT-Red Loose on Real Systems

OpenAI demonstrated GPT-Red attacking a real-world agent: the Vendy vending machine running in OpenAI's office (built by Andon Labs). GPT-Red successfully:

Changed an expensive in-stock item's price to $0.50
Ordered a $100+ item for $0.50
Canceled another customer's order

These aren't theoretical vulnerabilities. These are production agent attacks, and GPT-Red found them through prompt injection in conversational and tool-output channels.

In a separate test against Codex CLI (GPT-5.4 Mini), GPT-Red outperformed a prompted GPT-5.5 baseline on data exfiltration tasks — achieving more successes while using fewer tokens.

The Safety Flywheel

This is the part that has long-term implications for anyone building on top of OpenAI's platform.

OpenAI describes a safety flywheel: precursors to GPT-Red have been training defenders since GPT-5.3, and each successive release has been more robust. GPT-5.6 Sol is the first model trained entirely against the final GPT-Red, and the results are stark:

6× fewer failures on the hardest direct prompt injection benchmark compared to the best production model from 4 months ago
Direct prompt injection failure rate vs. GPT-Red: 0.05%
Indirect prompt injection benchmarks: >97% accuracy (saturated)

And critically — OpenAI claims all normal capabilities are preserved. The gains come from better resistance to malicious instructions, not from blanket refusal or degraded tool use.

"Using today's models to directly help make future models safer."

Each model generation helps train the next attacker, which helps train the next defender. The loop doesn't stop.

Where It Still Falls Short

GPT-Red isn't a silver bullet. It has clear limitations:

Conversational attacks: It struggles with multi-turn attacks that require back-and-forth dialogue. Human red-teamers handle this easily.
Multimodal inputs: It's not yet effective at crafting image-based attacks, which are an emerging vector.
Not publicly available: OpenAI is keeping GPT-Red fully internal. They're confident it's sufficiently hard to replicate — requiring over a year of development backed by industrial-scale compute — that no external actor can easily reproduce it.

"I think human expertise will still be very important. It would be really useful to be able to distinguish where human testing is most needed." — Jessica Ji, Georgetown CSET

What This Means for Everyone Else

If you're building AI agents that handle money, execute code, or read emails — and especially if you're deploying tool-using agents — this matters today.

The threat model just changed. Until now, you could roughly gauge your risk by thinking about what a determined human attacker could figure out. That ceiling just got raised by 6x. The attacks GPT-Red is discovering — Fake Chain-of-Thought, complex tool-output injections, multi-variant prompt injections — will eventually make their way into the public domain as researchers study them. The window between "OpenAI knows about this attack" and "everyone knows about this attack" has been shrinking with every model release.

OpenAI says a technical preprint is coming later this week. I'll be reading it closely, and I'll follow up here with the details that matter for developers building on these platforms.

For now, one takeaway: the era of humans being the primary red-teamers for AI systems is ending. AI-to-AI red-teaming is not a research experiment anymore — it's a production requirement.

Sources: OpenAI Blog — GPT-Red: Unlocking Self-Improvement for Robustness | MIT Technology Review — Meet GPT-Red | The Verge — OpenAI trained an AI for red-teaming AI | The Decoder — OpenAI is now using AI to attack its own AI