内容来源：https://www.technologyreview.com/2026/07/15/1140514/meet-gpt-red-an-llm-super-hacker-openai-built-to-make-its-models-safer/

内容总结：

OpenAI打造超级黑客AI“GPT-Red”，用于自研模型安全加固

据MIT科技评论独家报道，OpenAI近日研发出一款名为“GPT-Red”的超级黑客大语言模型（LLM），专门用于攻击自家其他AI模型，以帮助其提升网络防御能力。该公司上周发布的最新旗舰模型GPT-5.6，正是在与GPT-Red的对练中，成为其史上最坚固的版本。

GPT-Red的核心作用是自动化“红队测试”——一种传统上由人类测试团队执行的软件安全评估方法，旨在尽可能多地发现系统漏洞，以便在最终版本发布前修复。随着大语言模型日益复杂，尤其在以“智能体”形式运作、能够与文件、网站、第三方代码及其他智能体交互时，人为安全测试已显吃力。GPT-Red的联合创建者、OpenAI研究科学家尼基尔·坎德帕尔表示：“风险面在扩大，爆炸半径也在增加。”

OpenAI表示，GPT-Red的设计初衷是让安全测试流程具备“面向未来”的能力。另一位联合创建者、研究科学家迪伦·哈恩指出：“随着更强大的模型出现，我们已经设计了能够发现新型攻击方式的系统。”据悉，GPT-Red已自主发现了此前从未见过的新攻击类型。

OpenAI将主要精力集中于“提示注入”攻击，即黑客向LLM植入恶意指令，使其执行开发者或用户不愿进行的操作，如复制机密信息、破坏代码库或生成有害内容。理论上，此类指令可隐藏于任何LLM可能接触到的文本中，例如代码或网站内容。

训练“道场”：自我对练中越战越强

为打造GPT-Red，研究人员将其作为一个未经黑客训练的LLM，与其他多个模型置于“自我对练”循环中。其目标是攻击其他模型，而被攻击模型则需进行防御。经过多轮对练，GPT-Red的攻击能力持续提升，而防御模型也愈加坚固。整个训练在OpenAI设计的“道场”中进行，模拟了LLM在真实世界可能部署的多种场景，包括浏览网页、读取邮件或日历、编辑代码等。

当GPT-Red发现一种新攻击方式时，会探索其多种变体，以找到针对特定场景最高效的攻击路径。哈恩说：“相比人类红队测试员，它非常擅长找出真正有效的手段，并且对已发现的攻击具有极强的深挖能力。”

尤为值得注意的是，GPT-Red发现了一种此前未被研究人员知晓的新型提示注入攻击，命名为“虚假思维链”。思维链是LLM在解决问题时记录中间结果的一种“日记”机制。GPT-Red找到在另一模型思维链中插入虚假条目、诱使其使用伪造信息的方法。团队成员克里斯·肖凯-周形容：“就像我告诉你1+1=3，并且你已经验证过一样，模型就会说‘哦，好吧’，然后输出3。”

实战表现：效率优于人类，成功攻克90%旧模型漏洞

乔治城大学安全与新兴技术中心高级研究分析师杰西卡·纪认为，OpenAI采用的自我对练“看起来很有希望”。在测试中，OpenAI让GPT-Red重复2025年人类红队测试员对早期GPT-5版本的漏洞挖掘实验，结果GPT-Red在寻找有效攻击方面比人类更成功。此外，GPT-Red还能入侵由Andon Labs开发的自动售货机智能体“Vendy”，成功修改商品价格并取消客户订单。

在防御测试中，OpenAI将GPT-Red发现的最强攻击应用于自家模型：针对去年8月发布的GPT-5，超90%的攻击成功；而针对新版GPT-5.6，成功率已降至不足23%。

局限与未来：GPT-Red不会开放，人类专家仍不可替代

尽管如此，GPT-Red并非完美无缺。它在需要多轮对话的攻击场景中表现不佳，而人类黑客对此得心应手。同时，它还不擅长利用图像传递文本进行提示注入攻击。OpenAI表示，GPT-Red是对人类红队测试的补充，人类仍能发现它遗漏的漏洞。目前OpenAI的一种做法是，将人类发现的攻击方式提供给GPT-Red，让其寻找所有变种。杰西卡·纪指出：“人类专业知识依然非常重要，区分哪些测试最需要人类参与，将很有价值。”

不出意外，OpenAI不会公开发布GPT-Red。该公司相信，GPT-Red比任何可能的模仿模型都更强大。研究人员表示，他们已在该模型上工作超过一年，依靠的是全球最富有公司之一的计算资源支持。肖凯-周强调：“这不是一件谁都能轻易做到的事——你知道的，不是随便就能用这个想法训练出一个超级攻击者。”

中文翻译：

Meet GPT-Red：OpenAI 打造了一个超级黑客大语言模型，旨在提升其模型的安全性
独家报道：该公司表示，他们希望让其安全流程经得起未来考验，并领先于人类攻击者。

OpenAI 打造了一个名为 GPT-Red 的超级黑客大语言模型，将其用作陪练伙伴，帮助其其他模型增强抵御网络攻击的能力。上周，该公司发布了其旗舰大语言模型 GPT-5.6 的最新版本。OpenAI 表示，通过与 GPT-Red 进行对抗训练，该模型成为了迄今为止最稳健的版本。

GPT-Red 自动化了一种针对软件系统的安全评估方式，即“红队测试”，这项工作通常由人类测试团队完成。其目标是尽可能多地找到破坏或劫持系统的方法。随后，在软件最终版本发布前，这些薄弱环节可以得到修补。

随着大语言模型变得越来越复杂，并被应用于更广泛的任务中——尤其是以智能体形式出现，它们能与计算机文件、网站、第三方代码以及其他智能体进行交互——纯粹由人类团队来应对可能发生的所有攻击类型变得愈发困难。“风险面在扩大，影响范围也在扩大，”OpenAI 的研究科学家、GPT-Red 的联合创建者尼基尔·坎德帕尔表示。

OpenAI 打造 GPT-Red，是为了让其安全测试流程经得起未来考验。“随着更强大的模型不断出现，我们将已经设计出能够发现新型攻击模式的系统，”该公司研究科学家、GPT-Red 的另一位联合创建者迪伦·哈恩表示。研究人员称，GPT-Red 已经构想出了一些此前从未出现过的新型攻击方式。

OpenAI 将大部分精力集中在一类被称为“提示注入”的攻击方式上。在这种攻击中，黑客会向大语言模型植入指令，使其做出开发者或用户不希望它做的事情，例如复制机密信息、破坏公司的代码库，或者生成令人尴尬或有害的输出。理论上，这类指令可以隐藏在大语言模型可能遇到的任何文本中——比如代码中或网站上。

训练道场
为了构建 GPT-Red，OpenAI 的研究人员选取了一个未经黑客训练的大语言模型，并将其置于所谓的“自对弈循环”中，与另外几个模型进行对抗。它的目标是尝试攻击其他模型；而这些模型的目标则是尝试保护自己。经过多轮对弈，GPT-Red 在攻击其他大语言模型方面变得越来越强，而那些大语言模型在抵御攻击方面也变得越来越出色。

训练在一个 OpenAI 设计的“道场”中进行，该环境模拟了大语言模型可能在现实世界中部署的各种场景，包括浏览网页、阅读电子邮件或日历应用，以及编辑代码。

当 GPT-Red 发现一种新型攻击时，它会探索该攻击的多种不同变体，以便找到针对特定场景最高效的方式。“与人类红队测试人员相比，这个模型非常、非常擅长找出哪些方法会奏效，哪些方法最有效，”哈恩说。“在深挖它发现的攻击方式方面，它极其执着。”

OpenAI 特别指出，GPT-Red 发现了一种研究人员此前从未见过的提示注入攻击，他们称之为“虚假思维链”。思维链是大语言模型在解决问题时，为自己做笔记并追踪部分结果的一种“日记”。GPT-Red 找到了一种方法，将虚假条目插入到另一个模型的思维链中，从而诱骗该模型根据伪造信息采取行动。

“这就好比我对你说 1+1=3，并且告诉你你已经验证过了，”该团队的另一位研究科学家克里斯·肖凯-褚说。“模型就会想，‘哦，好吧，当然是这样’，然后直接得出 3 这个结果。”

杰西卡·纪是乔治城大学安全与新兴技术中心（CSET）专注于人工智能安全的高级研究分析师，她认为 OpenAI 使用的自对弈循环是一个良好的方法。“这些结果看起来非常有前景，”她说。

OpenAI 通过重做一项 2025 年的实验来测试 GPT-Red 作为攻击者的能力，在那次实验中，人类红队测试人员试图在早期版本的 GPT-5 中寻找弱点。当 GPT-Red 被分配同样的任务时，它在寻找有效攻击方面的成功率超过了人类。

OpenAI 还让 GPT-Red 与 Vendy——一个由 Andon Labs 开发的自动售货机智能体——进行了对抗测试，该公司专门评估智能体执行现实世界任务的能力。GPT-Red 成功入侵了 Vendy，使其改变了在售商品的价格，并取消了一位顾客的订单。

防御性行为
OpenAI 表示，当他们将 GPT-Red 想出的某些最强大的攻击手段应用于其模型时，超过 90% 的攻击对 GPT-5（去年 8 月发布）有效，而只有不到 23% 的攻击对新的 GPT-5.6 有效。

GPT-Red 并非完美无缺。它不擅长设计涉及黑客与目标之间来回对话的攻击，而人类攻击者在这方面几乎不会遇到什么问题。此外，它在利用图片方面也还不够出色，而图片在提示注入攻击中可用于向模型传递文本。

该公司表示，GPT-Red 是对其人类红队测试人员工作的补充。人类仍然可以发现它遗漏的攻击。OpenAI 采取的一种方法是，将人类提出的攻击方式交给 GPT-Red，并让其找出所有变体。

“我认为人类专业知识仍将非常重要，”CSET 的纪说。“能够区分哪些测试最需要人类参与将会非常有用。”

不出所料，OpenAI 不会发布 GPT-Red。该公司还相信，这个超级黑客要比任何人可能试图模仿创建的模型都更强大。研究人员表示，他们在这个模型上已经工作了一年多，并得到了全球最富有公司之一的计算资源支持。

“这可不是一件随便就能做到的事——你知道，光凭这个想法就去训练一个超级攻击者，”肖凯-褚说。

深度解析
人工智能
一家初创公司声称突破了阻碍大语言模型发展的瓶颈
Subquadratic 现已公布了其新模型的更多细节。但仍有一些人持怀疑态度。

关于 AI 工作恐慌的现实核查
数据究竟如何反映人工智能对劳动力市场的影响？答案可能会让你大吃一惊。

Anthropic 的 Code with Claude 展示了编码的未来——无论你喜欢与否
随着像 Claude Code 这样的工具不断改进，越来越多的开发者乐于将编码任务交给它们。软件的构建方式已经发生了永久性的改变。

Anthropic 发现了一个隐秘空间，Claude 在其中思考概念
一项新技术让该公司能够比以往任何时候都更深入地探究大语言模型的奇特工作机制。

保持联系
获取来自
MIT Technology Review 的最新资讯
发现特别优惠、热门故事、即将举行的活动等更多内容。

英文来源：

Meet GPT-Red: an LLM super-hacker OpenAI built to make its models safer
Exclusive: The firm says it wants to future-proof its safety procedures and stay ahead of human attackers.
OpenAI has built an LLM super-hacker called GPT-Red that it uses as a sparring partner to help its other models boost their defenses against cyberattacks. Last week the company released the latest version of its flagship LLM, GPT-5.6. OpenAI says that training it against GPT-Red made the model its most robust release yet.
GPT-Red automates a type of safety evaluation for software systems known as red-teaming, which is typically done by a team of human testers. The aim is to find as many different ways to break or hijack a system as possible. The weak spots can then be patched before the final version of the software is released.
As LLMs become more complex and get used in a wider variety of tasks—especially in the form of agents, which can interact with computer files, websites, and third-party code as well as other agents—it’s hard for teams of people by themselves to keep up with all the types of attacks that might take place. “The risk surface grows and the blast radius also grows,” says Nikhil Kandpal, a research scientist at OpenAI who co-created GPT-Red.
OpenAI built GPT-Red to future-proof its safety testing process. “As more capable models become available, we will have already designed the system that can discover new modes of attack,” says Dylan Hunn, a research scientist at the company and fellow co-creator of GPT-Red. The researchers say it has already come up with new types of attack that had not been seen before.
OpenAI focused most of its efforts on a type of attack known as a prompt injection, where a hacker slips an LLM instructions to make it do things its developers or users do not want it to, such as copy confidential information, sabotage a company’s code base, or generate embarrassing or harmful output. In theory, such instructions can be hidden in any text that the LLM might encounter—in code or on a website, for example.
Training dojo
To build GPT-Red, OpenAI’s researchers took an LLM that had not been trained as a hacker and set it up in what’s known as a self-play loop with several other models. Its goal was to try to attack the other models; their goal was to try to defend themselves. Over many rounds of play, GPT-Red became better and better at attacking other LLMs, and those LLMs became better and better at fending off the attacks.
The training took place in a kind of dojo that OpenAI had designed to mimic a range of scenarios in which LLMs might be deployed in the real world, including browsing the web, reading emails or calendar apps, and editing code.
When GPT-Red found a new kind of attack, it would explore multiple different versions of it to find the most efficient one for specific scenarios. “Compared to a human red-teamer, the model is very, very good at finding exactly what will work, exactly what’s most effective,” says Hunn. “It’s extremely persistent about drilling down into an attack that it has discovered.”
In particular, OpenAI claims that GPT-Red found a type of prompt injection attack that the researchers had not seen before, which they call a fake chain of thought. A chain of thought is a kind of diary in which an LLM makes notes to itself and keeps track of partial results as it works through problems. GPT-Red found a way to insert a fake entry into another model’s chain of thought that would trick that model into acting on spoofed information.
“It’s like if I told you that 1+1=3 and that you have verified this already,” says Chris Choquette-Choo, another research scientist on the team. “The model’s like, ‘Oh, okay, of course,’ and it just spits out 3.”
Jessica Ji, a senior research analyst who works on AI security at Georgetown University’s Center for Security and Emerging Technology (CSET), thinks the self-play loop that OpenAI used is a good approach. “The results look very promising,” she says.
OpenAI tested how good an attacker GPT-Red was by rerunning an experiment from 2025 in which human red-teamers tried to find weaknesses in an earlier version of GPT-5. When GPT-Red was set the same task, it was more successful at finding effective attacks than the humans had been.
OpenAI also tested GPT-Red against Vendy, a vending machine agent developed by Andon Labs, a company that assesses how well agents perform real-world tasks. GPT-Red was able to hack Vendy to make it change the prices of items on sale and cancel a customer’s order.
Defensive behavior
OpenAI says that when it tried out some of the strongest attacks that GPT-Red had come up with on its models, more than 90% of them worked against GPT-5 (released in August last year), and fewer than 23% worked against the new GPT-5.6.
GPT-Red isn’t perfect. It is not great at figuring out attacks that involve a back-and-forth conversation between hacker and target, something that human attackers would have few problems with. It is also not yet that great at using images, which can be used to pass text to models in prompt injection attacks.
The company says that GPT-Red supplements the work of its human red-teamers. People can still find attacks it misses. One approach OpenAI is taking is to give GPT-Red an attack that humans came up with and ask it to find all the variations.
“I think human expertise will still be very important,” says CSET’s Ji. “It would be really useful to be able to distinguish where human testing is most needed.”
Unsurprisingly, OpenAI will not be releasing GPT-Red. The company is also confident that the super-hacker is stronger than any copycat model someone might try to create. The researchers say they have been working on the model for more than a year, backed by the compute resources of one of the richest companies in the world.
“It’s not a trivial thing that someone could easily do—you know, just go and train a super-attacker using this idea,” says Choquette-Choo.
Deep Dive
Artificial intelligence
A startup claims it broke through a bottleneck that’s holding back LLMs
Subquadratic has now shared more details about its new model. But some are still skeptical.
A reality check on the AI jobs hysteria
What do the numbers really say about the impact of artificial intelligence on the labor market? The answer might surprise you.
Anthropic’s Code with Claude showed off coding’s future—whether you like it or not
As tools like Claude Code get better, more and more developers are happy to hand off coding tasks to them. The way software gets built has changed for good.
Anthropic found a hidden space where Claude puzzles over concepts
A new technique has let the company probe deeper than ever into the weird workings of an LLM.
Stay connected
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.