Here's what's on our plate today:

• 🔥 How OpenAI built an AI whose only job is to break other AIs.

• 💸 Big Tech's cash-flow squeeze, Huawei's chip trifecta, AI rules built for kids.

• 🛠️ Three things worth trying: Gandalf, garak, Promptfoo.

• 🗳️ Poll: should labs be allowed to build attack AIs?

Let’s dive in. No floaties needed.

The Laboratory

TL;DR

OpenAI's safest model yet was trained by a machine built to break it.

• Agents made it real: prompt injection turned dangerous once models could read email and run code. A state-linked group used it to run most of an espionage campaign through Claude Code.

• Manufacturing the enemy: OpenAI spent a year and frontier-scale compute on GPT-Red, an attacker built only to break models. It beat human red teamers 84% to 13%.

• Same capability, two directions: safety used to mean limiting capability. Now capability polices capability, attacker and defender improving because of each other.

• The dojo problem: GPT-Red is weakest at the drawn-out attacks that actually worked on Claude Code. A defender hardened against it is hardened against its attacks, not the world's.

• Stakes: the fire is expensive and confined to a few labs today. If everyone starts lighting them, safety and competition become the same race.

OpenAI’s new safety tool is an AI designed to break AI

Fire managers have a technique for ground they cannot afford to lose. Rather than waiting for a wildfire to arrive, they burn the land themselves, choosing the moment and the conditions under which the fire will spread. By the time the larger blaze reaches that patch of ground, much of its fuel is already gone. The logic has made prescribed burns a standard tool of modern firefighting. The danger is that the protective fire and the destructive one are fundamentally the same force. The outcome depends entirely on control.

The AI industry is beginning to adopt a similar approach. As AI systems have evolved from chatbots into agents capable of browsing the web, writing code, using software tools, and carrying out tasks on a user’s behalf, the number of ways to manipulate them has expanded as well. One of the most persistent threats is prompt injection, a technique that works by feeding a model instructions disguised as ordinary information. Once an agent starts interacting with emails, websites, documents, or software it did not create, distinguishing legitimate instructions from malicious ones becomes a security problem.

Researchers have already demonstrated that AI systems can be persuaded to carry out complex actions they were never intended to perform, sometimes by breaking an objective into a sequence of individually harmless steps. As agents become more capable and gain access to more tools, the cost of those failures rises with them, increasing the value of finding vulnerabilities before deployment rather than after.

That challenge has led frontier AI labs toward an unusual conclusion. Rather than waiting for attackers to discover vulnerabilities first, they are beginning to build attackers of their own and direct them against the systems they hope to protect. The largest example yet was described publicly this week.

The ground is worth defending

For most of the chatbot era, there was little to protect because a text-only model could mostly embarrass you. That changed when models became agents. Once AI could read emails, browse the web, edit code, and call tools, every action introduced a new vulnerability: the model had to process instructions written by people it could not distinguish from ordinary text.

The extent of the damage caused by prompt injection can be understood by examining past incidents. On one occasion, a state-linked group tricked Claude Code into running most of an espionage campaign against roughly 30 organizations. The operators told the model it was doing authorized security testing, and they broke the work into steps small enough to look innocent. That was enough for the AI to handle 80% to 90% of the tactical operations, with humans stepping in at only a handful of decision points. Attacks like this are still rare, but they are becoming more capable, which is exactly why labs want to find the weaknesses before deployment rather than after.

The controlled burn

To weed out or destroy the increasing number of malicious prompt injections, AI labs are now looking to deploy the age-old method of controlled burn.

On July 15, 2026, OpenAI described the fire it lit in response. The model is called GPT-Red, and its only purpose is to break other models. The training method is self-play, and it runs two sets of models against each other at once. GPT-Red earns its reward by slipping an instruction past a defender. The defenders earn theirs by refusing, while still finishing their assigned work.

Each time defenders learn to block an attack, attackers must invent new ones, creating a loop where both sides improve continuously. All of it runs inside what the researchers call a dojo, which imitates the places agents actually work, including browsing, email, calendars, and code editing.

OpenAI says it spent more than a year building GPT-Red, an AI system designed to attack other AI models. The project used computing resources on a scale comparable to some of the company's largest training efforts, aiming to identify weaknesses before anyone else could.

According to OpenAI, GPT-Red broke nearly every model it tested, including versions of GPT-5.5. Along the way, it uncovered a previously unknown attack type. In simple terms, the attack tricks a model into accepting false information as already verified, leading it to make decisions based on a lie.

OpenAI then used those discoveries to strengthen GPT-5.6, which was released six days before GPT-Red was announced. The company says the new model successfully blocks almost all of GPT-Red's attacks. On one benchmark, GPT-Red found a successful attack in 84% of scenarios, while human security researchers succeeded in only 13% of the same tests.

What the burn is for

Read one way, this is simply a company doing what any serious security organization should do. Instead of waiting for an attack, OpenAI built one.

For years, red teaming relied on human researchers probing systems for weaknesses. The problem was scale. Human experts can only design and test so many attacks, while AI systems are improving faster than security teams can keep up. That leaves companies with an uncomfortable choice: find vulnerabilities after deployment, or accept that many will go undiscovered.

GPT-Red is OpenAI's attempt to change that equation. Rather than relying solely on human researchers, the company built an AI system whose sole purpose is to find ways of breaking other AI systems. The result is a machine that can generate attacks continuously, at a volume no human team could match. The limiting factor has now shifted from the scale of human resources to the amount of compute power you are willing to spend.

That is what separates GPT-Red from earlier security tools. OpenAI is not automating a checklist; it is automating an adversary. The industry has spent the last three years asking whether safety can keep pace with increasingly capable models. OpenAI's answer is that it can, but only by building something equally capable and pointing it in the opposite direction.

The line

However, while the controlled-burn method works, the world is rarely divided into neat categories of safe and dangerous. A controlled burn remains useful only for as long as it stays under control, and losing control can be a matter of a single mistake.

That tension is visible in what OpenAI has actually built. It is designed to manipulate models, discover weaknesses, and find paths around safeguards. The reason it functions as a safety tool rather than a threat is not that it lacks those capabilities, but because OpenAI has chosen to keep them contained.

The argument for keeping it that way rests partly on scarcity. One of GPT-Red's creators told MIT Technology Review that training such an attacker is "not a trivial thing that someone else could easily do," pointing to more than a year of work backed by one of the richest companies on earth. The implication is that systems like GPT-Red remain difficult and expensive to build, limiting them to a small number of frontier labs.

Set against that is a different possibility: the manufactured fire may not resemble the real one. OpenAI says GPT-Red is weaker against prolonged, multi-step attacks and against instructions hidden in images. Those limitations matter because some of the most significant real-world incidents have relied on exactly those techniques. The campaign that manipulated Claude Code reportedly used a sequence of individually harmless instructions spread across a longer interaction rather than a single carefully crafted prompt.

That creates a problem that is difficult to measure from the outside. Whether that translates into resilience against the attacks that emerge in the real world is a different question. The reported 0.05% success rate may be accurate, but it still describes a contest between an attacker and a defender built, trained, and evaluated by the same organization. The rest of the world is left to infer how much of that result survives beyond the walls of the dojo.

What the season holds

A prescribed burn is ultimately a bet on the wind, made by people who believe they understand how the fire will behave once it is lit. The AI industry is now making a similar bet. Faced with increasingly capable attackers, labs are beginning to build their own attackers to strengthen the systems they eventually release. OpenAI has pursued that strategy with unusual care. GPT-Red remains inside the company, unavailable to customers, researchers, or the public.

The challenge is that the approach's success depends on assumptions outsiders cannot easily verify. OpenAI believes the attacker it built resembles the threats its models will face, is capable of exposing meaningful weaknesses, and can be kept contained. Those assumptions may all prove correct, but the evidence for them comes largely from the same organization that designed the attacker, trained the defender, and measured the outcome. A defender hardened against GPT-Red is, by definition, hardened against the attacks GPT-Red produces. Whether that resilience extends to the threats that emerge outside OpenAI's testing environment is a question the industry will only answer over time.

What GPT-Red demonstrates, however, is that the AI industry's approach to safety is beginning to change. For years, safety was largely framed as a constraint on capability, a set of guardrails designed to limit what increasingly powerful models could do. GPT-Red points toward a different philosophy. Instead of limiting capability, OpenAI is using capability to police itself, building an increasingly sophisticated attacker to harden an increasingly sophisticated defender. The attacker and defender improve together, and each becomes more capable because of the other.

That may be where the field was always headed. The logic is compelling, and it may prove effective. But it also carries the same risk that has always accompanied a controlled burn. The fire you light to protect the forest is still a fire. Today, systems like GPT-Red remain expensive, closely guarded, and confined to a handful of frontier labs. Tomorrow, they may not. If the future of AI safety depends on every major lab training ever more capable adversaries to defend ever more capable models, then the industry may discover that safety and competition are no longer separate pursuits, but the same race viewed from opposite sides. The question is not whether the burns are controlled today. It is whether they remain controlled once everyone starts lighting them.

Quick Bits, No Fluff

• The AI bill comes due: Big Tech's AI spending is on track to outrun the cash it throws off, with the top five hyperscalers set to invest more in capex than they generate in free cash flow by 2027.

• Huawei's chip trifecta: Reports suggest Huawei is quietly building its own DRAM fabs, a move that would make it and Samsung the only firms producing their own CPUs, SSDs, and memory in-house.

• Regulators put kids first: After the UN's first AI governance dialogue, 100-plus organizations are pressing governments to prove AI systems are safe for children before they ship, not after harm is done.

Thursday Poll

3 Things Worth Trying

• Gandalf: Lakera's browser game that dares you to trick an AI into leaking a secret password, the fastest way to feel prompt injection firsthand.

• garak: NVIDIA's open-source LLM vulnerability scanner, basically nmap for language models, probing for jailbreaks, leaks, and injection in one run.

• Promptfoo: Open-source red-teaming and eval framework that auto-generates attacks tailored to your app, so you break it before someone else does.

The Toolkit

• Perplexity: AI answer engine that searches the live web and cites every source, built for fast, trustworthy research.

• Gamma: Turns a single prompt into a polished deck, doc, or webpage, no design skills required.

• Suno: Generates studio-quality songs from a text prompt, lyrics and vocals included, for jingles, demos, or fun.

Rate This Edition