2026-09-18
每日一文 · 长文精读
GPT-6 Astra Is the First Model OpenAI Classifies as Critical for Cybersecurity
GPT-6 Astra 成为 OpenAI 首个被列为“关键”网络安全级别的模型
作者：Steef-Jan Wiggers · InfoQ 原文
摘要：OpenAI 将 GPT-6 Astra 列为“关键”网络安全级别，这是其准备框架下的最高等级。该模型在浏览器和操作系统内核中发现了多个未知漏洞，并能自主开发利用链。同时，其监控能力下降，可能进行“沙袋”行为，但整体安全性优于前代。微软在 Foundry 中提供该模型，并强调需要严格的控制措施。
OpenAI has classified GPT-6 Astra at the Critical level for cybersecurity capability under its Preparedness Framework, the first model to reach that threshold.
OpenAI 已根据其准备框架将 GPT-6 Astra 的网络安全能力列为“关键”级别，这是首个达到该门槛的模型。
Microsoft made the model generally available in Foundry Models the same day.
微软当天在 Foundry 模型中正式发布了该模型。
The distribution is broader than a single cloud.
其发布范围不仅限于单一云平台。
OpenAI's own announcement listed availability through ChatGPT tiers, the API, and AWS, without naming Azure, which drew comment on Hacker News.
OpenAI 的公告列出了通过 ChatGPT 各层级、API 和 AWS 提供的途径，但未提及 Azure，这引发了 Hacker News 上的评论。
One commenter drew the distinction that matters: being hosted on Azure is different from being provided by Azure, where the latter is a managed offering operated and billed by Microsoft under license.
一位评论者指出了关键区别：托管在 Azure 上不同于由 Azure 提供，后者是由微软根据许可运营和计费的托管服务。
The framework sets the Critical cybersecurity threshold at either of two conditions: a model that can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or one that can devise and execute end-to-end novel attack strategies against hardened targets given only a high-level goal.
该框架将“关键”网络安全门槛设定为两种情况之一：模型能够在无需人工干预的情况下，在许多加固的真实世界关键系统中识别并开发各种严重程度的可用零日漏洞；或者，仅给定高层目标，就能针对加固目标设计并执行端到端的新型攻击策略。
OpenAI states in the system card that Astra meets it.
OpenAI 在系统卡中表示 Astra 符合这一标准。
The evaluations behind that conclusion are specific.
这一结论背后的评估是具体的。
In expert-led testing against a browser and an operating-system kernel, with experts permitted to supervise only for safety and validation and barred from contributing knowledge or directing research, Astra discovered multiple previously unknown vulnerabilities in both.
在专家主导的针对浏览器和操作系统内核的测试中，专家仅被允许出于安全和验证目的进行监督，不得贡献知识或指导研究，Astra 在两者中发现了多个此前未知的漏洞。
It built a working exploit chain achieving unsandboxed code execution in the browser after 29 hours against a build later found to lack some production mitigations, then adapted the exploit to the official stable release in a further 12 hours.
它构建了一个可用的利用链，在 29 小时内实现了浏览器中的非沙箱代码执行，尽管该构建后来被发现缺少一些生产缓解措施，随后又用 12 小时将该利用适配到官方稳定版。
Against the OS kernel, it developed a working local privilege-escalation exploit within 12 hours.
针对操作系统内核，它在 12 小时内开发了一个可用的本地权限提升利用。
On a benchmark built from vulnerabilities disclosed after the model's knowledge cutoff, Astra discovered and used unknown zero-day vulnerabilities previously as part of its exploit chains.
在一个由模型知识截止后披露的漏洞构建的基准测试中，Astra 发现并使用了此前未知的零日漏洞作为其利用链的一部分。
OpenAI says it is disclosing two of those to maintainers, and is withholding product names, configurations and exploit mechanics to reduce risk to systems that may remain unpatched.
OpenAI 表示将其中两个漏洞披露给维护者，并隐瞒产品名称、配置和利用机制，以降低对可能仍未打补丁的系统的风险。
OpenAI says it strengthened cyber safeguards across the stack in response and updated its Trusted Access for Cyber program.
OpenAI 表示，作为回应，它加强了整个技术栈的网络安全防护，并更新了“网络可信访问”计划。
Internal handling of the model changed too, with stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought, and a blocking alignment evaluation before internal use.
模型的内部处理方式也发生了变化，包括更严格的隔离、检查点加密、对包括思维链在内的完整轨迹的全面监控，以及在内部使用前进行阻止性对齐评估。
A second finding in the same document complicates the safety picture.
同一文档中的第二个发现使安全状况复杂化。
OpenAI reports that Astra's monitorability has decreased relative to GPT-5.6 Sol:
OpenAI 报告称，与 GPT-5.6 Sol 相比，Astra 的可监控性有所下降：
We have found that GPT-6 Astra is more capable of controlling its own CoT than GPT-5.6 Sol, and less likely to include incriminating information in its CoT.
我们发现，GPT-6 Astra 比 GPT-5.6 Sol 更能控制自己的思维链，并且不太可能在思维链中包含不利信息。
Under adversarial conditions, where researchers instructed the model to evade monitoring, Astra remained undetected while strategically underperforming on evaluations, a behavior OpenAI calls sandbagging, and sometimes evaded internal monitors on sabotage tasks.
在对抗性条件下，研究人员指示模型逃避监控，Astra 在评估中战略性表现不佳而未被发现，OpenAI 称之为“沙袋”行为，有时在破坏任务中逃避内部监控。
OpenAI found no evidence of steganographic reasoning, which it takes as an indication that evasion risk may be bounded to lower reasoning tasks, and notes that its alignment evaluations show Astra is less likely than Sol to violate security and safety restrictions overall.
OpenAI 没有发现隐写推理的证据，它认为这表明逃避风险可能仅限于较低级别的推理任务，并指出其对齐评估显示，Astra 总体上比 Sol 更不可能违反安全和安保限制。
It also says the trend is taken seriously and underscores the need for alignment auditing techniques beyond examining chain of thought.
它还表示，这一趋势受到认真对待，并强调需要超越检查思维链的对齐审计技术。
On alignment more broadly, OpenAI reports that in a simulation using more than 54,000 internal Codex tasks, Astra received roughly half as many flags for higher-severity misaligned behavior as Sol.
在更广泛的对齐方面，OpenAI 报告称，在使用超过 54,000 个内部 Codex 任务的模拟中，Astra 因较高级别错误对齐行为而收到的标记数量约为 Sol 的一半。
Biological capability remains at the High level rather than Critical, with High safeguards retained.
生物能力仍保持在“高”级别而非“关键”级别，并保留了“高”防护措施。
Microsoft's Foundry announcement covers none of the cybersecurity classification, though it addresses the containment question the capability raises.
微软的 Foundry 公告未涉及网络安全分类，但解决了该能力引发的遏制问题。
Astra can interpret on-screen information and interact with approved interfaces, which Microsoft presents as a route into workflows without dedicated APIs.
Astra 可以解释屏幕信息并与经批准的接口交互，微软将其视为无需专用 API 即可进入工作流的途径。
It then states the exposure:
然后它说明了风险：
Capability this direct demands containment.
如此直接的能力需要遏制。
Content displayed in an application may be incomplete, misleading, or designed to influence an agent's behavior.
应用程序中显示的内容可能不完整、具有误导性或旨在影响代理的行为。
The recommended controls are scoped credentials, approved resources, human checkpoints for consequential actions, and activity records aligned to risk requirements.
建议的控制措施包括范围限定凭据、经批准的资源、对重大行动的人工检查点，以及符合风险要求的活动记录。
OpenAI's own testing reports that Astra is significantly more robust to prompt injection than Sol.
OpenAI 自己的测试报告称，Astra 对提示注入的鲁棒性明显高于 Sol。
Pricing places the model at the top of the Foundry catalog.
定价将该模型置于 Foundry 目录的顶端。
Standard Global runs $10 per million input tokens and $50 per million output on short context, rising to $20 and $75 on long context.
标准全局在短上下文中每百万输入令牌 10 美元，每百万输出 50 美元，长上下文则分别升至 20 美元和 75 美元。
The US Data Zone carries a 10% premium throughout.
美国数据区全程加收 10% 的溢价。
Cached input runs at a tenth of the input rate.
缓存输入按输入费率的十分之一计费。
For agentic workflows that accumulate context across steps, which is the use Microsoft positions the model for, the long-context tier is the one most likely to apply.
对于跨步骤累积上下文的代理工作流（这是微软为该模型定位的用途），长上下文层级最可能适用。
Deployment options cover Standard for variable demand and Provisioned Throughput for consistent latency, in Global and US Data Zone geographies.
部署选项包括用于可变需求的标准版和用于一致延迟的预置吞吐量，覆盖全局和美国数据区。
Foundry supplies Entra identity and access management, private networking, role-based access control, content filtering, safety evaluations and monitoring.
Foundry 提供 Entra 身份和访问管理、私有网络、基于角色的访问控制、内容过滤、安全评估和监控。
Microsoft states that these help customers configure safeguards but do not eliminate risk or replace an organization's responsibility for selecting appropriate controls.
微软表示，这些措施帮助客户配置防护，但并不能消除风险，也不能取代组织选择适当控制措施的责任。
OpenAI says it will continue investigating the monitorability findings as models become more capable, and describes preserving chain-of-thought monitorability as a core goal of its research program.
OpenAI 表示，随着模型能力的增强，它将继续调查可监控性发现，并将保持思维链可监控性描述为其研究计划的核心目标。
阅读理解
1. What is the primary reason OpenAI classified GPT-6 Astra at the Critical level for cybersecurity?
2. What did OpenAI find regarding Astra's monitorability compared to Sol?
3. According to Microsoft, what is a key risk when using Astra in applications?