OpenAI has spent the last six months building an AI whose sole purpose is to attack other AI models. The result is GPT-Red, and it is not available to the public. It is an internal tool, kept separate from all deployed models, used to find security weaknesses before anyone outside can exploit them.
The specific threat GPT-Red is built to find is called prompt injection. The name sounds technical, but the idea is straightforward. When an AI agent reads something, whether an email, a document, a webpage, or a file returned by a search tool, a third party can hide instructions inside that content. If the AI follows those hidden instructions instead of the original task it was given, the attacker wins. The AI becomes a tool working against its own user.
This is not a theoretical problem. In June 2025, researchers found that a single crafted email sent to a Microsoft 365 Copilot user could cause the AI to pull files from internal company storage and send them to an outside server. The user did not click anything or make any mistake. Copilot simply read their inbox and acted on what it found. That vulnerability was patched, but the same underlying attack pattern has since shown up across Salesforce, GitHub Copilot, and other widely-used AI tools. The Cloud Security Alliance found that 65% of organisations experienced at least one AI agent security incident in the past year, with 61% of those incidents involving data exposure.
GPT-Red works by playing both sides of this problem simultaneously. OpenAI trained it against a collection of AI defenders in a continuous loop: GPT-Red attacks, the defender resists, GPT-Red learns from failure and tries a different approach, and the defenders get harder as a result. By the end of training, GPT-Red could break nearly every model OpenAI had built, including production models up to and including GPT-5.5. In a test against human security experts, GPT-Red found successful attacks in 84% of scenarios; the humans managed 13%.
OpenAI then used GPT-Red to train GPT-5.6, which launched publicly on July 9. The result is a model six times harder to hijack on the hardest direct attack tests compared to the best OpenAI model from four months earlier. One specific class of attack that previously worked on GPT-5.1 more than 95% of the time now succeeds less than 10% of the time on GPT-5.6.
The real-world test was more striking. OpenAI gave GPT-Red access to an AI-powered vending machine running in its own office, similar to a system Anthropic tested publicly under the name Project Vend. GPT-Red was given a description of the machine and the ability to send it instructions. It achieved all three malicious goals it was set: it changed the price of an expensive item to 50 cents, ordered a new item costing over a hundred dollars and offered it at 50 cents, and cancelled another customer's order. OpenAI disclosed the vulnerabilities and is now testing fixes.
The broader point is this: AI agents that can take real actions, book things, send emails, read files, place orders, modify records, carry the same attack surface as any software system connected to the internet. The difference is that the attack does not require breaking any code. It requires hiding a sentence inside something the agent reads.
For business operators, the practical implication is not to avoid AI agents, but to treat them with the same access discipline you would apply to a junior employee with no security training. Agents should be able to read only what they need to read. They should need confirmation before taking irreversible actions. And if you are evaluating AI tools built on top of GPT-5.6, the security posture underneath is meaningfully better than it was six months ago, though no single layer is enough on its own.