OpenAI unveils GPT-Red, an LLM that hunts vulnerabilities in other AI models

OpenAI has developed GPT-Red, a large language model designed to automatically discover security flaws in other LLMs, leading to the company's most robust model yet, GPT-5.6.

This article was drafted with AI assistance from multiple sources and was reviewed and approved by a human editor before publication.

OpenAI has revealed GPT-Red, a large language model built specifically to find vulnerabilities in other LLMs through automated red-teaming. The system, developed by OpenAI research scientists Nikhil Kandpal, Dylan Hunn, and Chris Choquette-Choo, automates the safety evaluation process traditionally performed by human testers.

GPT-Red was trained using a self-play loop: it attacked other models, which defended themselves, and over many rounds both sides improved. The training scenarios included browsing the web, reading emails and calendar apps, and editing code. The development took over a year and required significant compute resources.

During testing, GPT-Red discovered a novel attack type called fake chain of thought, which inserts fake entries into another model's chain of thought. Choquette-Choo explained: "It’s like if I told you that 1+1=3 and that you have verified this already. The model’s like, 'Oh, okay, of course,' and it just spits out 3."

In a 2025 experiment on an earlier GPT-5 version, GPT-Red outperformed human red-teamers. It also hacked Vendy, a vending machine agent by Andon Labs, to change prices and cancel orders. Over 90% of GPT-Red's strongest attacks worked against GPT-5 in August 2025, but fewer than 23% worked against GPT-5.6, which was released last week in July 2026. This makes GPT-5.6 OpenAI's most robust model yet.

Kandpal noted, "The risk surface grows and the blast radius also grows." Hunn added, "As more capable models become available, we will have already designed the system that can discover new modes of attack." Hunn also said, "Compared to a human red-teamer, the model is very, very good at finding exactly what will work, exactly what’s most effective."

Despite its successes, GPT-Red has limitations: it is poor at attacks requiring back-and-forth conversation and at using images for prompt injection. OpenAI will not release GPT-Red publicly. Choquette-Choo commented on replicability: "It’s not a trivial thing that someone else could easily do—you know, just go and train a super-attacker using this idea."

Jessica Ji, senior research analyst at Georgetown CSET, commented: "The results look very promising." MIT Technology Review had exclusive access to GPT-Red.