OpenAI announced the latest cooperation progress with CAISI in the United States and AISI in the United Kingdom: joint evil assessment and end-to-end red teaming around ChatGPT Agent and GPT-5, discovering and fixing key vulnerabilities, iterating on biosecurity and product security stacks, and demonstrating a new paradigm of "government×industry" collaborative evaluation.
1. Quick Facts
1. Cooperation Layout and Timeline
OpenAI and CAISI's model security assessment, which lasted for more than a year, was extended to "proxy security"; The biosecurity cooperation with AISI in the UK has been continuously redteamed for ChatGPT Agent and GPT-5 since May, covering the entire link from model to product.
2. Key Discovery (Agent Security)
CAISI identified two new types of vulnerabilities in a joint exercise in July, which can be bypassed and combined into a complete exploitation chain under specific conditions. OpenAI accepts the same day and completes the repair and return within one working day, forming a rapid closed loop.
3. Biosecurity AISI
submittedmore than ten detailed reports on "universal jailbreak" and monitoring vulnerabilities in OpenAI's customized testing environment, promoting monitoring stack and product configuration patching, reducing the probability of malicious content bypassing and improving alert visibility.
2. Why is it important
1. Evaluation from "pre-launch" to "full cycle"
is not only a single pre-launch inspection, but also accompanied by the iterative continuous verification of ChatGPT Agent and GPT-5, emphasizing the engineering rhythm of "discovery-repair-re-test".
2. In-depth model of public-private collaboration
Governmentresearch institutions contribute expertise in network security and national security scenarios, and enterprises open system cards and prototype environments, and the two sides form a technical consensus on real systems to raise the industry security baseline.
3. Implications for developers and enterprises
Agents are regarded as a type of "manipulable automated client" that needs to be built in parallel with traditional web/terminal security to build routing, anti-escape, and behavior monitoring.
3. Landing list (can be applied directly)
(1) Agent security minimum set
a. Tool minimization and whitelist routing
b. Session-level permission sandbox isolation from the file system
c. Secondary confirmation and recording of high-risk actions
(2) Red teaming and observability
a. Introduce three types of scripts of "proxy hijacking, prompt injection, and data exfiltration"
b. Establish a failure sample database and restore scenes
c. Key indicators: interception rate, false positive rate, repair time
(3) Biosecurity governance
a. Set the protection threshold of high-capability domains with reference to the system card
b. Pre-load policy rules to the retrieval and tool layer
c. Implement hierarchical implementation and manual review
requests 4. Selection reminder for AI teams
1. Product stack
For scenarios of automation and cross-site operation, priority should be given to models and agents with "system card + external evaluation records" (such as ChatGPT Agent, GPT-5) to facilitate the alignment of audit and compliance.
2. Project stack
Write red team results to CI: each version update triggers jailbreak regression, agent tool permission regression, and content security regression.
3. Organize and coordinate
security, legal affairs, and products to share a "security change log" to achieve traceability of discovery, repair, and retesting.
Frequently Asked Questions (Q&A)
Q: What exactly did OpenAI, CAISI, and AISI do in this round of cooperation?
A: Conduct joint red teaming and system evaluations around ChatGPT Agent and GPT-5 to find new vulnerabilities at the agent level and complete fixes within one working day, while strengthening biosecurity monitoring and product configuration protection.
Q: What is the direct value for teams using ChatGPT Agent or GPT-5?
A: You can inherit the experience of actual combat confrontation style and repair from CAISI and AISI, and incorporate tests such as "proxy hijacking, general jailbreaking, and content extortion" into regression to reduce the risk of production accidents.
Q: How is the System Card used in engineering?
A: Use the system cards of GPT-5 and ChatGPT Agent as "security function manuals" to convert high-capability domain thresholds, monitoring indicators, and disabling lists into executable policies and test cases.
Q: Is it enough to do only pre-launch penetration testing?
A: Not enough. Refer to this cooperation for "full-cycle evaluation": version grayscale - red team reappearance - rule implementation - regression verification, and continue to cover the attack surface of new features and new tools.
