OpenAI describes an LLM-based attacker trained end-to-end with reinforcement learning that searches for prompt injections able to steer the Atlas browser agent through long, multi-step harmful workflows, and a rapid response loop that adversarially trains new agent checkpoints against discovered attacks. OpenAI says the attacker found strategies absent from human red-teaming and external reports, and states that prompt injection is unlikely ever to be fully solved.
Why it matters
It shows a frontier lab using automated adaptive attackers as part of defense, echoing the adaptive-evaluation lesson.
Key facts
As stated in the sources, with where to find them.
- The RL attacker can propose candidate injections and test them in an external simulator during its reasoning, and targets workflows spanning tens to hundreds of steps.Automated attack discovery section
- Recommendations to users: logged-out mode where possible, review confirmation requests, give narrowly scoped instructions.Recommendations section
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Mar 10, 2026
Feb 13, 2026
Jan 28, 2026
Nov 7, 2025
Feb 5, 2026
Nov 24, 2025