OpenAI and Microsoft have unveiled new cybersecurity initiatives that point to how the industry is quickly shifting from using GenAI as an assistant to deploying autonomous systems that can identify and respond to emerging cyber threats.
The announcements come as enterprises face increasingly sophisticated AI-enabled attacks, with security vendors warning that autonomous agents are beginning to automate vulnerability discovery, exploitation and ransomware campaigns at machine speed.
For customer experience leaders, the developments have implications beyond IT security. Contact centers, customer service platforms, CRM systems and AI agents increasingly rely on connected enterprise data, making prompt injection, data exfiltration and identity attacks growing operational risks.
OpenAI Uses AI to Attack AI
OpenAI has introduced GPT-Red, an internal automated red-teaming system designed to discover vulnerabilities in AI systems before attackers do.
The GPT-Red model uses self-play reinforcement learning to generate increasingly sophisticated attacks against other language models. As defensive models become stronger, GPT-Red adapts to uncover new weaknesses, creating a continuous improvement cycle for model security.
"GPT‑Red achieves significantly higher attack success rates, finding success on 84% of scenarios compared to 13% for humans," OpenAI stated.
That type of result is significant for customer experience because prompt injection is not only a chatbot safety issue. As AI agents are connected to software repositories, enterprise applications, customer records and third-party tools, malicious instructions hidden inside otherwise trusted content can influence systems that are capable of taking action.
Vincent Danen, Vice President of Product Security at Red Hat, highlighted that risk in a recent CX Today interview. “In particular when you’re looking at things like prompt injection, other types of malware...I think of an agent working on a Git repo that may have malware in it or some hidden prompts that make it do certain things, you want to be able to constrain what that agent can do using those sandboxes.”
GPT-Red also demonstrated the ability to manipulate a real-world autonomous vending machine agent by reducing product prices, ordering expensive inventory and cancelling customer orders after first refining its attacks in a simulated environment. OpenAI said the identified vulnerabilities have since been disclosed and mitigations are being tested.
The vending machine example illustrates a larger issue for enterprises, as once AI agents are connected to business systems, the risks move from inaccurate responses to unintended actions. Danen said organizations need to understand the surrounding technologies and limit the potential damage when autonomous agents behave unexpectedly.
“Being well versed in those different technologies and keeping abreast of them will ensure your blast radius will be a little bit less if these autonomous agents decide to go off and do things on their own that you didn’t design or want them to do.”
OpenAI has already been using earlier versions of GPT-Red to strengthen successive GPT releases, reporting significant reductions in prompt injection success rates and improvements in resistance to indirect prompt injection attacks.
"After GPT‑Red completed training, we used it to generate prompt injections for the training of GPT‑5.6, resulting in the model becoming highly resistant to GPT‑Red’s attacks," OpenAI stated. "We keep GPT‑Red separate from the models we deploy. This keeps the malicious capabilities we specifically train into GPT‑Red out of the hands of adversarial actors, while instilling robustness into our production models."
Rather than becoming a customer-facing product, GPT-Red will remain an internal capability used to harden future OpenAI models.
Microsoft Brings Human Experts Into the AI Loop
While OpenAI is automating vulnerability discovery, Microsoft is focusing on accelerating incident response.