OpenAI has developed GPT-Red, a specialized large language model designed exclusively for automated AI safety testing. Rather than assisting users, the system functions as an internal adversary, continuously probing OpenAI’s own models to identify vulnerabilities and enhance their resilience against malicious inputs. This development marks a significant shift toward automated red teaming, a practice traditionally reliant on human security researchers who manually attempt to hijack or compromise AI systems. As large language models gain the ability to interact with external files, browse the web, and coordinate with other agents, the expanding attack surface has outpaced manual testing capabilities. GPT-Red addresses this challenge by scaling vulnerability discovery across increasingly complex environments. The model was trained using a self-play methodology within a simulated workspace that replicates real-world operational tasks, including email processing, web navigation, and code editing. During training, GPT-Red competed against multiple defensive models, iteratively refining its offensive strategies while the defense systems adapted to new threat patterns. This adversarial loop enabled the system to uncover previously undocumented attack vectors, most notably a technique termed fake chain of thought. This method allows an attacker to inject misleading information directly into a model’s internal reasoning process, tricking it into treating fabricated intermediate steps as verified conclusions and subsequently executing unintended actions. According to OpenAI researchers Nikhil Kandpal and Dylan Hunn, the system consistently demonstrates a superior ability to identify high-success-rate attacks compared to human analysts, who often struggle to exhaustively map evolving attack pathways. Performance benchmarks confirm the model’s efficacy. In a reassessment of a 2025 vulnerability hunt targeting an earlier GPT-5 iteration, GPT-Red successfully identified more effective exploits than the original human red team. Furthermore, applying these newly discovered attack methods to legacy versions of the architecture yielded success rates exceeding 90 percent. However, deployment against the latest flagship model, GPT-5.6, reduced those success rates to under 23 percent, underscoring the defensive improvements directly attributable to GPT-Red’s testing cycle. Despite these gains, the system exhibits clear limitations. It currently struggles with multi-turn interactive exploits and image-based prompt injections, areas where human researchers retain a distinct advantage. Consequently, OpenAI positions GPT-Red as a complementary tool rather than a replacement for human expertise. The company’s current workflow pairs human-led strategy design with automated variant generation to maximize test coverage. OpenAI will not release GPT-Red publicly, citing the substantial computational infrastructure and prolonged training cycles required to develop such a sophisticated adversarial system. Industry observers, including CSET senior analyst Jessica Ji, have praised the self-play approach as a pragmatic solution to the escalating complexity of AI security. As autonomous agents become more deeply integrated into enterprise and consumer workflows, automated red teaming frameworks like GPT-Red are likely to establish new benchmarks for proactive vulnerability management, ensuring that next-generation AI systems can withstand increasingly sophisticated digital threats.