Analysis
Gray Swan, a Pittsburgh-based AI security startup, relaunched its public red-teaming platform on October 20 as "Arena 2.0," rebuilt around AI agents instead of chatbots, Fortune reported. The centerpiece is a competition called "Indirect Prompt Injection (IPI) Black," Gray Swan's largest yet, with $300,000 in prizes sponsored by Anthropic, Meta, Google DeepMind and Reflection AI. New attack scenarios release weekly through November 2.
From academic research to enterprise product
Gray Swan grew out of AI safety research at Carnegie Mellon University. Cofounders Matt Fredrikson (CEO) and Zico Kolter (chief scientist) were among the researchers who showed in 2023 that automatically generated character strings could defeat guardrails on ChatGPT, Bard and Claude -- the kind of adversarial-prompt research that's now Gray Swan's commercial core. Kolter also chairs OpenAI's independent Safety and Security Committee and sits on the OpenAI Foundation board, putting one of Gray Swan's own cofounders inside the governance structure of one of its named clients.
“The company raised a $40 million Series A in May 2026, co-led by Wing Venture Capital and Madrona, with no valuation disclosed.”
The company raised a $40 million Series A in May 2026, co-led by Wing Venture Capital and Madrona, with no valuation disclosed. Headcount has grown from roughly 15 employees at the start of 2026 to 66 today. Its clients include Anthropic, OpenAI and Google DeepMind, which use Gray Swan to stress-test frontier models before release, alongside commercial products Shade (continuous vulnerability testing) and Cygnal (runtime attack detection) sold to enterprises deploying their own AI systems.
What the original Arena showed
Pulse has covered Arena's evolution before. The first version launched in September 2024 and built a community of roughly 15,000 participants, measured by Discord activity. Its most striking finding: Chinese open-source models were typically jailbroken within minutes, while OpenAI and Anthropic models usually held out for close to a day. That gap is one of the few public, standardized data points comparing model robustness across labs, which is part of why AI labs themselves are now sponsoring the next version rather than treating it as adversarial.
The catch in "agentic" red-teaming
Fredrikson told Fortune that AI-driven attackers now outperform humans at generating large volumes of attack variations, but humans still lead at inventing genuinely new jailbreak techniques, which is why Gray Swan still runs a public, human-driven contest rather than relying only on automated red-teaming. Arena 2.0's rules require a human to actively drive each agent under test, and participants who let an agent run unsupervised and off-task are barred from current and future competitions. That's a real scope limit: the contest measures how agents behave under active human direction, not the harder question of what happens when an agent is given a task and left alone.
Gray Swan says it doesn't train directly on Arena submissions, instead analyzing which attacks succeed to build better automated red-teaming tools, meaning the contest functions as both marketing and a live R&D pipeline. With four frontier labs now sponsoring prize money against their own products, the real test of Arena 2.0 is whether any disclosed vulnerability actually changes a shipped model's guardrails, or whether this becomes an annual publicity exercise.
