OpenAI GPT-RED and Fudan AgentCyberRange Usher in the Era of AI Self-Play Cybersecurity

In July 2026, the AI security field reached three simultaneous milestones that collectively mark the transition from “humans testing AI” to “AI testing AI.” OpenAI unveiled GPT-RED, a dedicated automated red-team model; Fudan University’s Professor Yang Min team open-sourced AgentCyberRange, the first high-fidelity AI attack-and-defense benchmark built on real network ranges; and the UK AI Security Institute (AISI) published quantitative evidence that frontier models’ autonomous cyber-attack capabilities are doubling every four months.

GPT-RED: Self-Play Trained AI Red Teaming

OpenAI’s GPT-RED (released 15 July 2026) is trained exclusively to discover security flaws before models are deployed. Its core innovation is a Self-Play Reinforcement Learning architecture in which GPT-RED acts as the attacker while successive generations of defensive models act as defenders inside realistic “Dojo” environments that simulate web browsing, email handling, calendar operations, and code editing. The resulting data show dramatic gains: indirect prompt-injection success reached 84 % versus 13 % for human red-team experts (6.5× improvement), and the strongest attacks against GPT-5 succeeded more than 90 % of the time while the same techniques succeeded less than 23 % against the hardened GPT-5.6 Sol model.

One previously unknown attack class discovered by GPT-RED is the “Fake Chain-of-Thought” injection. By planting fabricated reasoning steps inside a model’s internal scratchpad, an attacker can make the model believe a malicious premise has already been verified. Success rates exceeded 95 % on GPT-5.1 and remained below 10 % even on the adversarially trained GPT-5.6 Sol. Real-world validation included compromising an office vending-machine agent to alter prices and cancel orders, and outperforming prompted GPT-5.5 in ten data-exfiltration scenarios inside Codex CLI environments.

AgentCyberRange: Scoring Real-World AI Hacking Ability

Released in June 2026, AgentCyberRange provides the first standardized, high-fidelity benchmark for autonomous AI cyber capabilities. Its orchestration engine Cage uses a four-layer modular architecture (Agent Adapter, Agent Manager, Benchmark Manager, Verifier) that runs every agent inside isolated Kali Linux containers equipped with standard penetration-testing tools. The benchmark comprises 110 vulnerabilities across 15 real-world applications (WordPress, Dify, DataEase, etc.) spanning 17 vulnerability classes, including 18 zero-days and 56 one-days, plus eight enterprise post-exploitation ranges containing 156 internal hosts and real EDR solutions.

Among six evaluated systems, GPT-5.5 (Codex framework) achieved the highest scores: 19.09 % Pass@1 on web exploitation and 31.71 % on post-exploitation. It was the only model to make significant use of the professional fuzzing tool ffuf and discovered a previously unknown arbitrary-file-write zero-day in the popular ComfyUI project. Performance dropped sharply on deeper endpoints (35 % at depth 2 versus 11 % at depth 6), and all agents exhibited poor OPSEC, repeatedly triggering honeypots.

AISI UK: Measuring Exponential Capability Growth

The UK AISI tracked seven models over 18 months on two high-fidelity scenarios—“The Last Ones” (32-step enterprise network attack) and “Cooling Tower” (7-step industrial-control attack). Average steps completed rose from 1.7 (GPT-4o, August 2024) to full completion (Claude Mythos, April 2026). The institute concluded that autonomous cyber-attack ability is advancing at a doubling rate every four months and scales log-linearly with inference-time compute.

Three Converging Trends and Remaining Risks

The three initiatives together demonstrate that scalable AI security now requires an “AI versus AI” flywheel: stronger attack models generate richer adversarial data that in turn produce stronger defenses. Prompt injection remains an architectural issue because LLMs treat system instructions, user input, and external content as a single token stream. GPT-RED raises the bar but does not eliminate the attack surface; CrowdStrike’s 2026 report already documented more than 90 organizations hit by prompt-injection attacks, including a zero-click vulnerability (CVE-2025-32711) against Microsoft 365 Copilot. Replicating GPT-RED demands frontier-lab compute resources, while AgentCyberRange’s open-source release helps narrow the evaluation gap. Nevertheless, the rapid capability-doubling curve underscores that defenders must accelerate the same self-play paradigm if they are to keep pace.