OpenAI Built an AI That Jailbreaks Its Own Models to Make Them Safer

News Summary

OpenAI has revealed details of an internal system called GPT-Red, an automated red-teaming model trained specifically to attack the company's own frontier AI systems in order to uncover safety weaknesses before they can be exploited in the real world. The disclosure, made public on July 15, 2026 (Eastern Time), describes how the tool was used extensively during the development and safety evaluation of GPT-5.6, and how its findings were fed back into training to make the released model substantially more resistant to manipulation.

What GPT-Red Does

GPT-Red is designed to probe for prompt injection vulnerabilities, a class of weakness in which an attacker embeds hidden or malicious instructions inside content that a model processes, attempting to override the system's original task. Rather than relying solely on human testers to manually search for these flaws, OpenAI built GPT-Red as a dedicated attacking model that continuously generates new attack strategies and tests them against defender models in a controlled environment.

A Self-Play Training Loop

The system was trained using a self-play reinforcement learning approach, in which an attacking model and a set of defending models improve by repeatedly competing against each other. The attacker earns a reward when it successfully induces a defender to follow an injected instruction, while the defender is rewarded for correctly rejecting the malicious input while still completing the legitimate task it was originally given. As the defenders grow better at spotting known attack patterns, GPT-Red is pushed to discover more varied and sophisticated techniques, and those newly discovered attacks are then used to retrain the defenders. OpenAI describes this as an escalating cycle in which offensive and defensive capabilities improve together over time.

Outperforming Human Red Teams

According to figures shared by OpenAI, GPT-Red succeeded in roughly 84 percent of test scenarios, compared with about 13 percent for human red-teamers working on the same set of challenges. The company said this gap illustrates how automated, large-scale adversarial testing can surface vulnerabilities far faster and more consistently than manual review alone, while emphasizing that human expertise remains an important complementary layer of evaluation.

Discovering a New Attack Class

One notable outcome of the project was that GPT-Red independently identified a previously undocumented attack pattern researchers have since called the "fake chain-of-thought" attack. This technique targets reasoning models, which generate explicit intermediate reasoning steps before producing a final answer. The attack works by inserting a fabricated entry into that reasoning trace, leading the model to behave as though it had already verified a false premise. Reports indicate that before mitigation, such attacks succeeded more than 95 percent of the time against the GPT-5.1 model. After GPT-Red's findings were used to retrain the newer system, the success rate for the same style of attack fell below 10 percent against GPT-5.6.

Human Expert Testing Continues Alongside Automation

OpenAI noted that automated red-teaming is intended to complement, not replace, its existing Red Teaming Network, which includes more than 200 external specialists spanning fields such as chemistry, biosecurity, cybersecurity, law, and multilingual linguistics. These external reviewers continue to evaluate models before and after release, working alongside the automated system to test safeguards against creative, real-world misuse attempts.

Significant Computing Investment

The company said it dedicated substantial computing resources, reported at over 700,000 GPU hours, to running automated searches for so-called universal jailbreaks during the development of GPT-5.6. OpenAI also said automated red-teaming will continue to run during the model's deployment period, allowing new vulnerabilities to be identified and patched on an ongoing basis rather than only during a fixed pre-release testing window.

Why It Matters for AI Safety Research

Researchers and industry observers have pointed to GPT-Red as an example of a broader trend in AI safety: using AI systems themselves to test and harden other AI systems at a scale and speed that manual testing cannot match. As reasoning models become more capable and more widely deployed in autonomous or agentic settings, tools like GPT-Red are seen as an important step toward building safeguards that can keep pace with increasingly sophisticated attack techniques, while still leaving room for human judgment on the hardest and most novel safety questions.