OpenAI 用 AI 攻击自家 AI：GPT-Red 自动发现安全漏洞，成功率 84% 远超人类

OpenAI训练了一个内部AI模型，叫做GPT-Red，用于自动发现GPT模型的安全漏洞。GPT-Red模拟提示注入：https://the-decoder.com/openai-admits-prompt-injection-may-never-be-fully-solved-casting-doubt-on-the-agentic-ai-vision/ 以及其他攻击方式，其中恶意指令隐藏在电子邮件、网站或文件中。通过自我博弈强化学习训练，GPT-Red在防御模型阻挡时进行攻击，并且双方随着时间提升能力。在测试场景中，它找到了84%的成功攻击，而人类红队成员只有13%。在一次测试中，它操纵了OpenAI办公室内的AI自动售货机，修改价格，并取消了其他客户的订单。

这些结果直接用于训练。OpenAI表示，GPT-5.6 Sol：https://the-decoder.com/openais-claude-mythos-competitor-gpt-5-6-sol-launches-under-government-controlled-access-it-calls-unsustainable/ 在直接提示注入测试中的失败率比四个月前的最佳模型低六倍，同时未影响总体性能。但约有3.8%的“强提示注入”仍然成功。如果放大到数百或数千次尝试，就会有相当数量通过，这与Claude Opus 4.5：https://the-decoder.com/claude-opus-4-5-resists-prompt-injections-better-than-rivals-but-still-falls-to-strong-attacks-alarmingly-often/ 类似。

GPT-Red保持内部使用；一篇包含更多细节的论文将随后发布。Ad DEC_D_Incontent-1 广告

保持对AI的关注。内容清晰、有用，无废话。

关注The Decoder，获取AI新闻、背景故事和专家分析。

The Decoder：https://the-decoder.com/

OpenAI trained an internal AI model called GPT-Red to automatically find security flaws in GPT models. GPT-Red simulates prompt injections：https://the-decoder.com/openai-admits-prompt-injection-may-never-be-fully-solved-casting-doubt-on-the-agentic-ai-vision/ and other attacks where malicious instructions hide in emails, websites, or files. Trained via self-play reinforcement learning, GPT-Red attacks while defender models block, and both improve over time. It finds successful attacks in 84 percent of test scenarios versus 13 percent for human red teamers. In one test, it manipulated an AI-powered vending machine in OpenAI's office, changed prices, and canceled other customers' orders.

The results feed directly into training. GPT-5.6 Sol：https://the-decoder.com/openais-claude-mythos-competitor-gpt-5-6-sol-launches-under-government-controlled-access-it-calls-unsustainable/ shows six times fewer failures on direct prompt injections than the best model from four months ago, OpenAI says, without hurting general performance. But about 3.8 percent of "stronger" prompt injections still succeed. Scale that to hundreds or thousands of attempts, and a sizable number get through, similar to Claude Opus 4.5：https://the-decoder.com/claude-opus-4-5-resists-prompt-injections-better-than-rivals-but-still-falls-to-strong-attacks-alarmingly-often/.

GPT-Red stays internal; a paper with more details will follow. Ad DEC_D_Incontent-1 Ad

Stay in the loop on AI. Clear, useful, no fluff.

Follow The Decoder for AI news, background stories and expert analyses.

The Decoder：https://the-decoder.com/