Meet GPT-Red: an LLM super-hacker OpenAI built to make its models safer

OpenAI has deployed an internal large language model called GPT-Red designed to function as an adversarial testing tool. The system identifies vulnerabilities in OpenAI's models by simulating cyberattacks and security exploits, helping the company harden its defenses before release.

The company used GPT-Red extensively during development of GPT-5.6, its latest flagship model. According to OpenAI, training against GPT-Red's adversarial probes produced what the company calls its most robust release to date. The approach treats security like competitive training, where one model acts as the attacker while others learn to defend.

This red-teaming methodology automates what traditionally required human security researchers manually probing for weaknesses. GPT-Red accelerates vulnerability discovery by systematically testing edge cases, prompt injection attacks, and other exploit vectors that could compromise model safety or integrity. The automation allows OpenAI to stress-test at scale before deployment.

The strategy reflects a growing recognition in AI safety that language models can be weaponized. Attack vectors include prompt injection, where malicious inputs trick models into ignoring safety guardrails. Social engineering prompts manipulate models into producing harmful content. Token smuggling and other encoding tricks bypass content filters. By having an AI adversary continuously probe these surfaces, OpenAI identifies flaws faster than manual review alone permits.

However, the effectiveness of this approach depends on whether GPT-Red actually discovers the full spectrum of real-world attacks. Security by internal red-teaming risks missing novel exploit techniques that external actors might devise. OpenAI's approach also doesn't address fundamental alignment problems, where models behave unexpectedly even without adversarial input.

The release of GPT-5.6 comes as AI security increasingly dominates industry discussions. Multiple research teams have demonstrated that large language models remain vulnerable to various attacks despite safety training.