OpenAI today launched GPT-Red, a large-language model that acts as an automated red-team hacker. The system is already hardening the company’s latest GPT-5.6 model, slashing the success rate of simulated attacks from over 90 % to under 23 %.
How GPT-Red automates red-team work
Red-team testing—deliberately trying to break or hijack a system—has traditionally relied on security experts. As LLMs learn to browse the web, run code and call third-party services, the ways they can be misused multiply faster than a human team can explore.
OpenAI answered with a “self-play loop” that pits one copy of a model against another inside a simulated environment the researchers call a dojo. In this sandbox, GPT-Red takes the attacker role while one or more defender models try to resist. The two sides run countless rounds; each iteration forces the attacker to uncover subtler flaws and the defender to learn new defenses. OpenAI baked this process into the training pipeline that produced GPT-5.6, which the company touts as its most robust release yet.
A new class of attack: the fake chain of thought
The self-play runs uncovered a striking “fake chain of thought” attack. LLMs often emit a step-by-step reasoning trace—a “chain of thought”—that guides the final answer. GPT-Red learned to insert spurious entries into that trace, making the model think it had already verified false premises. For example, the attacker can convince the model that “1 + 1 = 3” has been checked, prompting the system to produce outputs based on the fabricated result.
The attack isn’t limited to pure text generators. In a test against “Vendy,” a vending-machine-style agent built by an external lab, GPT-Red manipulated price fields and cancelled orders, proving the technique works against specialized agents that act on user commands.
Measurable security uplift
OpenAI released figures that show the impact of training against GPT-Red. When the strongest attacks generated by the new model were run against the August-release GPT-5, more than 90 % succeeded. The same attacks against GPT-5.6 succeeded fewer than 23 % of the time.
In a 2025 experiment that pitted GPT-Red against human red-teamers, the AI discovered and refined attack variations more efficiently than the humans, suggesting an adversarial model can explore a broader slice of the vulnerability space in less time.
Limits and the continuing need for human expertise
GPT-Red does not replace human security analysts. It still stumbles on multi-turn conversational attacks, where the attacker builds a narrative over several exchanges, and on visual prompt injections that hide malicious text inside images. OpenAI plans to use the model as a first-line probe, surfacing promising attack ideas for human experts to investigate and extend.
The tool remains proprietary, so external researchers cannot directly test its capabilities or verify the reported gains.