Back to Blog
Research

GPT-Red and the Case for Reinforcement Learning Red Teaming

Why adaptive attackers are becoming necessary—and why agents still need system-level proof

PL
ProofLayer Research Team
July 20, 202618 min read

Static red teaming asks whether yesterday's attacks still work. Reinforcement learning asks what attack works now, observes the result, and tries again.

OpenAI's GPT-Red makes that distinction concrete. It is an internal attacker trained through self-play reinforcement learning. It iterates against defender models, learns from valid failures, and produces attacks that can be used to harden later models.[1]

The release is an important signal for security leaders. Adaptive red teaming is becoming necessary for capable AI. It is not sufficient by itself. A model can be robust in a chat test while an agent still misuses a tool, poisons memory, or changes production state.

The executive answer

Reinforcement learning closes the adaptation gap

AI systems change faster than a manual test plan. Models update. Prompts change. Tools gain permissions. MCP servers appear. Attackers see every response and adjust.

A fixed benchmark cannot do that. It can confirm that a known control still works. It cannot reliably discover the next tactic after the control succeeds.

01 STATIC
Replay known attacks
Best for regression
02 ADAPTIVE
Learn from each response
Best for discovery
03 CONTINUOUS
Repeat after every change
Best for evidence

The right claim is not “RL replaces red teams.” The right claim is “RL gives red teams an attacker that improves at machine speed.”

OpenAI, July 2026

What GPT-Red actually is

GPT-Red is not a ChatGPT feature and it is not a public product. OpenAI describes it as an internal automated safety red-teaming model. The company keeps it separate from deployed models because it is intentionally trained to produce effective attacks.[1]

Its training loop contains an attacker and a population of defender models. The attacker receives a reward for causing a valid failure. Defenders receive rewards for resisting while still completing the original task. Stronger defenders force the attacker to find stronger attacks.

The environment defines the threat model. It specifies what the attacker controls, such as a file, webpage, email, or tool output. It also defines what success means. That last part matters: red teaming becomes useful only when the reward represents a real security failure.

Self-play security loop
01
Attack
Try a tactic
02
Observe
Score the outcome
03
Learn
Update the policy
Why reinforcement learning

Four properties that prompting alone does not guarantee

01

It optimizes for an observed outcome

A prompted attacker can generate plausible attacks. An RL attacker can be trained to prefer attacks that actually cause the defined failure.

02

It learns across attempts

The attacker can use response feedback to change strategy. This matches a real adversary more closely than replaying isolated payloads.

03

It supports long-horizon behavior

Rewards can cover a sequence: plant an instruction, trigger retrieval, induce a tool call, then verify the resulting state change.

04

It creates a defensive flywheel

Successful attacks become training data and regression tests. The defender improves, which raises the difficulty for the next attacker.

Earlier research established the central tradeoff. Prompted attacks can be diverse but weak. Optimized attacks can be effective but collapse into repeated tactics. Multi-step RL and novelty rewards improve both effectiveness and tactical diversity.[3][4][5]

Comparison

Five approaches solve different parts of the problem

There is no single best red-team method. The strongest program combines methods and assigns each one a clear job.

ApproachHow it worksBest strengthMain limitBest use
Human expertsThreat-led exploration and judgmentNovel context, intent, and business impactSlow, expensive, and hard to repeat after every releaseThreat modeling and unknown-unknown discovery
Static probesFixed prompts, payloads, and benchmarksFast, deterministic regression testingMeasures known attacks; saturates as defenses learn the setCI gates and control verification
Prompted searchAn LLM proposes and revises attacksBlack-box, flexible, and inexpensive to startQuality depends on the base model and search policyBroad discovery against APIs and agents
Gradient attacksOptimize tokens against model internalsStrong optimization signal in white-box settingsOften unrealistic; needs model access; weak transfer is commonModel research and worst-case analysis
RL and self-playReward successful outcomes across repeated interactionLearns adaptive, multi-step attack policiesOnly as honest as the environment, reward, and coverageContinuous adversarial training and system-level campaigns

Use static probes to prevent regressions. Use human experts to define threat models. Use adaptive search and RL to discover what fixed tests miss.

The architectural divide

Red teaming a model is not red teaming an agent

A model produces tokens. An agent can change the world. It reads untrusted content, calls tools, retains memory, delegates work, and acts under an identity.

That changes both the attack and the proof. A harmful response is not enough. The test must verify whether the agent exposed a secret, executed code, changed a price, sent a message, or poisoned future behavior.

Dimension
Model
Agentic system
Target
A model endpoint
A model, prompts, tools, memory, identity, and orchestration
Typical attack
Direct jailbreak or harmful-output request
Indirect injection, tool misuse, memory poisoning, or cross-agent pivot
Success signal
The response violates a policy
The system changes state, calls a forbidden tool, or exposes data
Time horizon
Usually one turn or a short dialogue
Multi-step and sometimes cross-session
Required evidence
Prompt, response, and judge result
Full trace: input, tool calls, state change, asset, and outcome
False safety
The model refuses more
The agent appears safe because it stops completing legitimate work
Blast radius
Content generated to one interaction
Production data, credentials, payments, code, and other agents

AgentDojo evaluates utility and security across realistic tasks, tools, and untrusted data.[7] AgentHarm requires an agent to retain enough capability after a jailbreak to complete a harmful multi-step task.[8] Newer work shows that black-box attacks can outperform gradient methods in realistic agent environments, but transfer across models remains uneven.[9]

The reward must represent the business failure

Reward “the judge disliked the response” and the attacker learns model behavior. Reward “the unauthorized transfer completed” and it learns system security.

The GPT-Red evidence

Adaptive attackers can improve both discovery and defense

84% vs. 13%

GPT-Red versus human red-teamers on a replicated held-out indirect prompt-injection arena against GPT-5.1.

3 of 3 goals

A production-like vending agent changed prices, offered an expensive item for $0.50, and canceled another order.

10 held-out tasks

GPT-Red outperformed a prompted GPT-5.5 baseline on Codex CLI data-exfiltration scenarios while using fewer tokens.

6× fewer failures

OpenAI reports GPT-5.6 Sol improved on its hardest direct prompt-injection benchmark versus its best production model four months earlier.

All four figures are OpenAI-reported results. The arena was an internal replication. GPT-Red remains internal, and OpenAI has not released its weights or full training stack.[1]

The independent arena behind that evaluation also matters. It collected 272,000 attempts from 464 participants across tool-calling, coding, and computer-use settings. Every tested model was vulnerable, and some strategies transferred across models.[6] This is strong evidence that fixed model benchmarks do not capture the full agentic attack surface.

Necessary, not sufficient

What reinforcement learning does not solve

Reward validity. A weak judge rewards convincing text instead of a real breach. Instrument the target and score observable state.

Mode collapse. An attacker can repeat one successful tactic. Add goal diversity, novelty rewards, and coverage constraints.

Transfer failure. An attack learned on one model or harness may not transfer. Re-run against each production configuration.

Simulation gap. A sandbox can omit permissions, latency, middleware, or human approvals. Validate high-confidence findings in a production-like environment.

Utility loss. A defender can look safe by refusing useful tasks. Measure task completion and over-refusal beside attack success.

Information hazards. A strong attacker is dual-use. Restrict access, retain audit logs, and disclose findings responsibly.

Dynamic benchmarks reinforce the same lesson: a defense can appear secure on fixed tasks while failing on changing plans, third-party instructions, or unseen workflows.[10]

Operating model

Build a portfolio, not a single test

GPT-Red is a training system inside OpenAI. Enterprises need a deployment system around their own AI. The practical architecture has six layers.

01

Threat model

Name the assets, attacker control, permissions, and forbidden outcomes.

02

Static regression

Run known prompt injection, tool abuse, memory, and policy tests in CI.

03

Adaptive discovery

Use black-box search and RL attackers against each deployed system.

04

Outcome verification

Confirm tool effects, state changes, data exposure, and cross-session persistence.

05

Replayable evidence

Store the prompt, response, tool trace, affected asset, severity, and owner.

06

Continuous loop

Re-run after every model, prompt, tool, MCP server, permission, or policy change.

A red-team finding becomes valuable when engineering can replay it, risk can prioritize it, and an auditor can see what control changed.

The attack catalog must also cover system risks. OWASP's Agentic Top 10 includes goal hijacking, tool misuse, identity abuse, memory poisoning, insecure inter-agent communication, cascading failures, and rogue agents.[11]

Buyer checklist

Seven questions for a red-teaming vendor

  1. 01What exact outcome counts as a successful attack?
  2. 02Does the test validate a real tool effect or only grade model text?
  3. 03Can the attacker adapt across attempts and multi-step workflows?
  4. 04How do you prevent repeated tactics from inflating coverage?
  5. 05Do you measure legitimate task completion beside attack success?
  6. 06Can every finding be replayed with its full tool and state trace?
  7. 07Which system changes automatically trigger another campaign?
Conclusion

The future is an adversarial learning loop

GPT-Red is important because it shows that red teaming can become a training primitive. The attacker improves the defender. The stronger defender creates a harder curriculum. Each cycle produces new attacks and stronger controls.

For model developers, that loop improves model robustness. For enterprises, the loop must extend through the full agentic system. Code, prompts, tools, identities, memory, MCP servers, and production state all belong inside the test boundary.

Reinforcement learning is becoming necessary because the adversary adapts. System-level evidence remains necessary because the consequence happens outside the model.

Attack. Verify. Prove. Repeat.

Continuous adversarial evidence is how security leaders keep proof current after every AI release.

Talk to ProofLayer
Research notes

Primary sources

  1. [1]OpenAI. GPT-Red: Unlocking Self-Improvement for Robustness
  2. [2]OpenAI. Advancing red teaming with people and AI
  3. [3]Beutel et al.. Diverse and Effective Red Teaming with Auto-generated Rewards and Multi-step Reinforcement Learning
  4. [4]Perez et al.. Red Teaming Language Models with Language Models
  5. [5]Hong et al.. Curiosity-driven Red-teaming for Large Language Models
  6. [6]Dziemian et al.. How Vulnerable Are AI Agents to Indirect Prompt Injections?
  7. [7]Debenedetti et al.. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
  8. [8]Andriushchenko et al.. AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
  9. [9]Hofer, Debenedetti, and Tramèr. Assessing Automated Prompt Injection Attacks in Agentic Environments
  10. [10]Li et al.. AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?
  11. [11]OWASP GenAI Security Project. OWASP Top 10 for Agentic Applications 2026
Published July 20, 2026.← Back to all posts