OpenAI is betting that the best way to defend its newest AI systems is to unleash another AI against them first. The company’s new internal model, GPT-Red, was built to behave like an automated attacker, probing for prompt-injection weaknesses before those flaws can be exploited in the wild.

That decision captures a widening tension in the AI industry: as models become more capable and more deeply connected to code, files, websites, and outside tools, the job of breaking them safely before deployment is becoming too large and too fast-moving for human testers alone.

The story began with OpenAI’s effort to harden its latest flagship systems as they took on more complex tasks. In conventional software security, red-teaming means attacking a system the way an adversary would, with the goal of uncovering weaknesses before release. OpenAI adapted that logic to large language models, training GPT-Red as what MIT Technology Review described as an “LLM super-hacker” designed to make the company’s models safer.¹

According to OpenAI’s own account, the model was built to focus heavily on prompt injection, one of the most persistent problems in modern AI systems. In those attacks, malicious instructions are hidden inside text, code, or websites that a model encounters, nudging it to ignore its intended rules and do something developers never meant it to do. OpenAI says that by testing against GPT-Red, it was able to strengthen GPT-5.6 Sol, making it the company’s “most robust model to prompt injections to date.”²

The company’s researchers framed the project as a response to scale. As language models evolve into agents that can interact with external systems, the number of possible failure modes grows rapidly. MIT Technology Review, citing OpenAI researcher Nikhil Kandpal, reported the company’s concern in plain terms: “The risk surface grows and the blast radius also grows.”¹ That is the central case for automation here. Human red teams can still find important flaws, but OpenAI argues they may no longer be enough on their own.

OpenAI also says GPT-Red was not simply prompted to attack; it was trained to improve through repeated adversarial practice. The company set up what MIT Technology Review described as a “self-play loop,” in which GPT-Red tried to break other models while those models tried to resist. Over many rounds, the attacking model became better at discovering novel ways through defenses.¹ OpenAI researchers told the magazine that the system had already generated attack methods that had not been seen before, strengthening the company’s claim that automated red-teaming could uncover more than a static checklist of known threats.¹

By July 15, OpenAI and its executives began presenting the project publicly. Greg Brockman, the company’s president, introduced it on X as “GPT-Red — improving model security through automated red teaming of prompt injection vulnerabilities.”Greg Brockman (gdb)³ In the embedded OpenAI post he amplified, the company called GPT-Red “an internal automated red teamer” built to find “prompt injection vulnerabilities at scale,” adding that the aim was to build “stronger defenses before wider deployment.”https://twitter.com/OpenAI/status/2077446718728425686⁴

That messaging was quickly echoed at the top of the company. Sam Altman reposted OpenAI’s announcement, repeating the line that GPT-Red was designed to identify prompt-injection flaws at scale before broader release.Sam Altman (sama)⁵ The executive emphasis mattered: OpenAI was not presenting GPT-Red as a research curiosity, but as a concrete part of its production safety pipeline.

Reporting from The Verge underscored the company’s confidence in the model’s offensive ability. Citing OpenAI’s blog post, the publication wrote that GPT-Red “can break nearly all models it is pitted against.”² The same report said OpenAI used it to uncover vulnerabilities in GPT-5.6 Sol, helping turn that model into its strongest defense yet against prompt injections.² Taken together with the company’s own posts, the picture is of a system intentionally trained to be unusually good at manipulating and subverting other AI systems so those weaknesses can be patched before customers encounter them.

Still, even in the favorable coverage, a second perspective sits just beneath the surface: the more powerful these automated attackers become, the more uncomfortable the underlying premise can look. OpenAI’s argument is that offensive capability, carefully controlled, is necessary for defense. But that same idea raises a familiar question from cybersecurity and dual-use research: when does a defensive tool also become a dangerous capability in its own right?

The available reporting does not suggest OpenAI is releasing GPT-Red publicly. On the contrary, the company has described it as internal, and its statements emphasize predeployment testing rather than outside use.⁴ Yet the rationale for building it points to a broader industry reality. AI systems are no longer confined to chat windows; they are increasingly asked to operate across digital environments where hidden instructions, poisoned data, or malicious webpages can trigger harmful behavior. In that environment, a red teamer that can attack tirelessly, at machine speed, offers obvious appeal.

OpenAI’s researchers also presented the system as a way to stay ahead of future attackers, not just current ones. MIT Technology Review reported that co-creator Dylan Hunn said, “As more capable models become available, we will have already designed the system that can discover new modes of attack.”¹ That is a more ambitious claim than simple bug-finding. It suggests OpenAI sees automated adversarial testing as part of the long-term infrastructure of frontier-model safety.

A few days later, Brockman tied that security work to OpenAI’s broader cyber ambitions. In another X post, he wrote that “GPT-5.6 Sol is the state of the art in cyber” and said the model was showing “significant results in applying it to finding and fixing novel vulnerabilities.”Greg Brockman (gdb)⁶ That remark widened the frame beyond internal evaluation. It hinted at a future in which OpenAI wants its models not only to resist cyberattacks, but to actively help defenders secure real-world systems.

What emerges chronologically is a clear progression. First, OpenAI confronted a scaling problem in AI safety testing as its models became more capable and agentic.¹ Next, it trained GPT-Red through adversarial self-play to act as an automated attacker specialized in prompt injection and related exploits.¹ Then it used that system to pressure-test GPT-5.6 Sol, which OpenAI says emerged more robust as a result.² Finally, the company moved to publicize the effort through press coverage and executive posts, casting GPT-Red as both a practical security layer and a sign of where AI safety work is heading.³⁴

In that sense, the launch of GPT-Red is less a standalone product announcement than a marker of a changing security philosophy. OpenAI is arguing that defending advanced AI increasingly requires advanced AI on the other side of the table. Supporters will see that as a realistic response to fast-expanding attack surfaces. Skeptics will note that it also normalizes the creation of ever more capable machine hackers, even if they are built for internal use. For now, OpenAI is presenting GPT-Red as a shield. But the debate around it turns on whether the sharpest shields inevitably start to resemble weapons.