{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/openai-atlas-rl-automated-attacker-2025/",
 "asOf": "2026-09-26",
 "id": "openai-atlas-rl-automated-attacker-2025",
 "date": "2025-12-22",
 "datePrecision": "day",
 "title": "OpenAI hardens ChatGPT Atlas with an RL-trained automated prompt injection attacker",
 "lane": "defense",
 "kind": "framework",
 "summary": "OpenAI describes an LLM-based attacker trained end-to-end with reinforcement learning that searches for prompt injections able to steer the Atlas browser agent through long, multi-step harmful workflows, and a rapid response loop that adversarially trains new agent checkpoints against discovered attacks. OpenAI says the attacker found strategies absent from human red-teaming and external reports, and states that prompt injection is unlikely ever to be fully solved.",
 "whyItMatters": "It shows a frontier lab using automated adaptive attackers as part of defense, echoing the adaptive-evaluation lesson.",
 "actors": [
  "openai"
 ],
 "topics": [
  "prompt-injection"
 ],
 "atlas": [
  "untrusted-content",
  "model"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://openai.com/index/hardening-atlas-against-prompt-injection/",
   "publisher": "OpenAI",
   "title": "Continuously hardening ChatGPT Atlas against prompt injection attacks",
   "date": "2025-12-22",
   "type": "primary",
   "accessed": "2026-09-25"
  },
  {
   "url": "https://techcrunch.com/2025/12/22/openai-says-ai-browsers-may-always-be-vulnerable-to-prompt-injection-attacks/",
   "publisher": "TechCrunch",
   "title": "OpenAI says AI browsers may always be vulnerable to prompt injection attacks",
   "date": "2025-12-22",
   "type": "secondary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "The RL attacker can propose candidate injections and test them in an external simulator during its reasoning, and targets workflows spanning tens to hundreds of steps.",
   "locator": "Automated attack discovery section"
  },
  {
   "fact": "Recommendations to users: logged-out mode where possible, review confirmation requests, give narrowly scoped instructions.",
   "locator": "Recommendations section"
  }
 ],
 "significance": 3,
 "fideQuestions": [],
 "methods": [
  "adaptive-red-teaming",
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}