GPT-Red от OpenAI: автоматический red teaming через self-play против prompt-инъекций

OpenAI unveiled GPT-Red in July 2026 — an automated red teaming system in which a language model attacks itself through self-play, finds vulnerabilities, and learns to close them. The project's key goals, as described on OpenAI's blog, are safety, alignment, and robustness against prompt injections.

How self-play works in GPT-Red

GPT-Red automates red teaming: one role of the model generates attacking prompts, the other learns to recognize and deflect them, and the cycle repeats without human involvement. The principle follows the approach of AlphaGo from DeepMind: in 2016, the program became the strongest Go player by playing against itself — now the same self-play mechanic is applied not to a board game but to hunting for holes in the defenses of language models.

"GPT-Red uses self-play to improve AI safety, alignment, and robustness to prompt injections," reads the announcement of the publication on

OpenAI's blog.

Classic red teaming runs up against people: experts manually devise provocative scenarios, and such specialists are scarce on the market. An automated system removes the scale limitation — the model generates and tests orders of magnitude more attacks than any human team, does so continuously, and can be restarted after every weights update.

Why this matters for AI agents

A prompt injection is an attack in which a malicious instruction hides in external data — an email, a web page, or a document — and the agent executes it as if it were a command from its owner. OpenAI places robustness against prompt injections among the three main goals of GPT-Red, alongside safety and alignment — this is stated directly in the publication's announcement.

For browser and email agents this protection is critical: a model that reads the internet inevitably reads attackers' instructions too. In the industry, prompt injections are considered the main unsolved problem of the agentic era — the more autonomy agents gain with access to a user's money, email, and files, the more expensive every missed attack becomes.

Self-improvement as a defense strategy

The title of OpenAI's publication — "Unlocking Self-Improvement for Robustness" — openly declares the bet on self-improvement: the model is not just tested from the outside, it makes itself more resilient. This changes the familiar asymmetry of cybersecurity, in which an attacker needs only one successful attempt while a defender must close every hole at once: now the automated attacker works on the defense's side and finds the vulnerability before a real adversary does.

There is no shortage of open questions: in its brief description, OpenAI provides no public metrics — how many vulnerabilities GPT-Red finds and by how much the share of successful injections drops after training. The practical effect can only be judged by the robustness of OpenAI's next model releases.

What this means

The safety of frontier models is turning from a manual audit into an automated pipeline: models are beginning to attack and fix themselves. If the GPT-Red approach scales, robustness against prompt injections will become a measurable characteristic of models — just like today's benchmark results on code or math.

Frequently asked questions

What is automated red teaming?

Red teaming means deliberately attacking a system to find vulnerabilities before malicious actors do. In GPT-Red this role is played not by a team of humans but by the model itself: through self-play it generates attacks on its own defenses and learns to withstand them.

What is a prompt injection and why is it dangerous?

A prompt injection is a hidden instruction in external data (an email, a page, a file) that the model mistakenly executes as a user command. For AI agents with access to email and a browser this is the main attack vector; it is precisely robustness against such injections that OpenAI names as one of GPT-Red's three goals.