大模型
computerworld.com ·
OpenAI发布GPT-6 Astra，首次跨过关键网络安全阈值
OpenAI推出GPT-6 Astra，据称在Preparedness Framework下首次达到'关键'网络安全风险等级，触发额外部署限制。模型已向有限组织开放，未来几天将向ChatGPT Plus、Pro、Business和Enterprise用户及API和AWS提供。API定价为每百万输入tokens 10美元，输出50美元。
AI推荐理由 OpenAI发布GPT-6 Astra，首次跨过网络安全'关键'阈值，具有重大技术意义。提供定价、可用性等具体信息，来源Computerworld可信，时效性强。
95
正文
OpenAI于周四推出了GPT-6 Astra，并透露这款新的旗舰模型已跨越其《准备框架》中网络安全风险的“严重”阈值，该公司称这一分类将触发额外的部署限制。
“GPT-6 Astra今天向有限的组织推出，未来几天将向所有ChatGPT Plus、Pro、Business和Enterprise用户开放，也可通过OpenAI API和AWS使用，”OpenAI在一份声明中表示。
据该公司称，企业管理员必须手动为其工作区启用Astra，因为该功能在发布时默认关闭。
OpenAI表示，开发者可以通过API以gpt-6-astra的名称访问Astra，或通过Amazon Bedrock访问，定价为每百万输入标记10美元，每百万输出标记50美元。Pro、Business和Enterprise用户还可获得名为Astra Pro的变体，公司表示Astra支持符合条件的API客户使用零数据保留功能。
公司声称在漏洞利用基准测试中取得满分
OpenAI表示，它在没有生产防护措施的情况下对Astra进行了ExploitBench测试，该模型得分100%，高于前代GPT-5.6 Sol的78.5%。在更广泛的漏洞利用开发基准ExploitGym上，公司称Astra的成功率达到42.4%，而Sol为30.3%，同时使用的输出标记更少。
“它识别和开发零日漏洞的能力可以帮助防御者发现并修补弱点，但也带来了对更强防护措施的需求，”OpenAI在博客文章中表示。
OpenAI还在发布前三个月内披露的漏洞上测试了Astra，以检查它是否能自行发现缺陷，而不是从训练数据中回忆旧漏洞。OpenAI表示，该模型在该测试中发现了两个新的零日漏洞，目前正将这两个漏洞披露给相关软件制造商。
Greyhound Research首席分析师Sanchit Vir Gogia表示，“严重”标签是一个披露事件，而非能力事件。
“Astra的能力在8月10日（OpenAI表示不能排除严重能力）和9月1日（表示已达到阈值）之间没有变化，”Gogia指出。“变化的是测试。模型没有变。”
他说，这颠覆了企业显而易见的应对方式。
“Astra现在是唯一一个企业真正了解其网络能力的前沿模型，因为它是唯一一个按照公开阈值进行衡量的模型，而每个未标记的模型已经位于企业凭据之后，从未以这种方式衡量过，除非其供应商选择衡量，否则也不会被衡量，”Gogia指出。“那些模型并不更安全。”
OpenAI表示，Astra的公开版本将拒绝高级攻击性任务，例如生成概念验证漏洞利用，但计划在未来几周通过名为OpenAI Daybreak的计划，为经过审查的防御者放宽这些限制。
此次发布是在OpenAI推出GPT-5.6 Sol之后进行的，该公司称Sol在发布时在ExploitBench上得分73.5%，而几个月前，Anthropic的Fable和Mythos模型因类似担忧被短暂撤出出口市场。
治理从模型转移到其周围的“护栏”
Gogia表示，更大的转变是推理现在转化为状态变化，因为错误的聊天机器人回答是信息问题，而错误的代理在客户记录系统中的操作是运营事件。
“因此，治理单元从模型上移开，”他说，认为相关问题不再是哪个模型获得批准，而是给定身份在控制干预之前能造成多大损害。
Kanerika的AI开发主管Amit Kumar Jena表示，可见性问题很具体：当代理通过用户界面行动时，记录系统将操作记录为人员，因此更新400个ERP行的代理显示为服务账户进行了400次更新，而没有记录是哪个指令或模型版本产生了这些更新。
“在监管机构或审计员要求查看的确切系统中，你失去了粒度，”Jena补充道。
OpenAI表示，它构建了一个新的评估，参考了涉及Hugging Face的事件，以测试给定不可能任务的模型是否会超出其授权范围。
“与GPT-5.6 Sol相比，后者在没有生产防护措施的情况下48%的时间超出了授权目标，而GPT-6 Astra在0%的情况下这样做，”声明补充道。
Gogia表示，更令人不安的发现是Astra表现更好但监控更差：OpenAI报告称，与Sol相比，思维链的可监控性下降，Astra不太可能透露有罪推理，其监控覆盖OpenAI自己的外部部署，但没有任何已发布的内容将该遥测扩展到客户。“OpenAI能够监控Astra并不意味着企业能够审计Astra，”Gogia说。
本文最初发表于CSO。
生成式AI人工智能安全
查看原文（中文正文为 AI 翻译）
OpenAI launched GPT-6 Astra on Thursday, disclosing that the new flagship model has crossed the “Critical” threshold for cybersecurity risk under its Preparedness Framework, a classification the company said triggers additional deployment restrictions.
“GPT‑6 Astra is rolling out today to a limited set of organizations and over the coming days will become available to all ChatGPT Plus, Pro, Business, and Enterprise users, as well as through the OpenAI API and AWS,” OpenAI said in a statement.
Enterprise administrators must manually enable Astra for their workspace, since access is off by default at launch, according to the company.
Developers can access Astra in the API as gpt-6-astra or through Amazon Bedrock, OpenAI said, priced at $10 per million input tokens and $50 per million output tokens. Pro, Business, and Enterprise users also get a variant called Astra Pro, and the company said Astra supports Zero Data Retention for eligible API customers.
Company claims perfect score on exploit benchmark
OpenAI said it tested Astra without production safeguards on ExploitBench, and that the model scored 100%, up from 78.5% for predecessor GPT-5.6 Sol. On ExploitGym, a broader exploit-development benchmark, the company said Astra reached a 42.4% success rate against 30.3% for Sol, while using fewer output tokens.
“Its ability to identify and develop zero-day exploits can help defenders find and patch weaknesses, but it also creates a need for stronger safeguards,” OpenAI said in the blog post.
OpenAI also tested Astra on vulnerabilities disclosed in the three months before launch, to check whether it could find flaws on its own rather than recalling old exploits from training data. The model found two new zero-day vulnerabilities during that test, OpenAI said, and it is now disclosing both to the software makers involved.
Sanchit Vir Gogia, chief analyst at Greyhound Research, said the Critical label is a disclosure event rather than a capability event.
“Astra’s capability did not change between 10 August, when OpenAI said Critical capability could not be ruled out, and September 1, when it said the threshold was met,” Gogia noted. “The testing changed. The model did not.”
That inverts the obvious enterprise response, he said.
“Astra is now the only frontier model whose cyber capability an enterprise actually knows, because it is the only one measured against a published threshold, while every unlabelled model already sitting behind enterprise credentials has never been measured that way and will not be until its vendor chooses to measure it,” Gogia pointed out. “Those models are not safer.”
OpenAI said the public version of Astra will refuse advanced offensive tasks such as generating proof-of-concept exploits, though it plans to loosen those restrictions for vetted defenders through a program called OpenAI Daybreak in the coming weeks.
The launch follows OpenAI’s rollout of GPT-5.6 Sol, which the company said scored 73.5% on ExploitBench at launch, and comes months after Anthropic’s Fable and Mythos models were briefly pulled from export markets over similar concerns.
Governance shifts from the model to the harness around it
Gogia said the bigger shift is that reasoning now translates into state change, since a wrong chatbot answer is an information problem while a wrong agent action inside a customer-record system is an operating event.
“The governance unit therefore moves off the model,” he said, arguing the relevant question is no longer which model is approved, but how much damage a given identity can do before a control intervenes.
Amit Kumar Jena, head of AI development at Kanerika said the visibility problem is concrete: when an agent acts through a user interface, systems of record log the action as a person, so an agent that updates 400 ERP rows shows up as a service account making 400 updates, with no record of which instruction or model version produced them.
“You lose granularity inside the exact system a regulator or auditor will ask to see,” Jena added.
OpenAI said it built a new evaluation, informed by an incident involving Hugging Face, to test whether a model given an impossible task would exceed its authorized scope.
“Compared to GPT‑5.6 Sol, which without production safeguards went beyond the authorized target 48% of the time, GPT‑6 Astra did this in 0% of cases,” the statement added.
Gogia said the more uncomfortable finding is that Astra behaves better and watches worse: OpenAI reports decreased chain-of-thought monitorability against Sol, with Astra less likely to reveal incriminating reasoning, and its monitoring covers OpenAI’s own external deployment but nothing published extends that telemetry to customers. “OpenAI being able to monitor Astra does not mean an enterprise can audit Astra,” Gogia said.
The article originally appeared on CSO.
Generative AIArtificial IntelligenceSecurity