# OpenAI 推出 GPT-5.6-Cyber，帮助防御者在攻击者之前发现漏洞

- 来源：The Decoder：AI News（RSS）
- 作者：Matthias Bastian
- 发布时间：2026-08-11 02:01
- AIHOT 分数：63
- AIHOT 链接：https://aihot.virxact.com/items/cmsnjzngu0bgcrohfvunwl6q2
- 原文链接：https://the-decoder.com/openai-launches-gpt-5-6-cyber-to-help-defenders-find-vulnerabilities-before-attackers-do

## AI 摘要

OpenAI 扩展 Daybreak 网络安全计划，新增 Blue 与 Red 两个访问层级，并推出专为进攻性安全研究训练的 GPT-5.6-Cyber 模型。

## 正文

Key Points

OpenAI is expanding its Daybreak cybersecurity program with two new access tiers and a dedicated AI model called GPT-5.6-Cyber, designed to help security professionals identify vulnerabilities and develop exploits at an early stage.

The program is split into two tracks: Daybreak Blue focuses on defensive tasks such as malware analysis, while Daybreak Red is geared toward offensive security research.

Through the Red tier, users gain access to GPT-5.6-Cyber, a model specifically trained for offensive security purposes that responds to nearly all sensitive security queries typically blocked by other AI models.

OpenAI is expanding its Daybreak program with two new access tiers and a specialized model called GPT-5.6-Cyber. The model is designed to help defenders spot vulnerabilities and build exploits before attackers can deploy AI-powered offensive tools at scale.

OpenAI says threat actors will increasingly use AI for cyberattacks, including fully autonomous ones. The window for defenders to prepare is getting smaller. Ironically, the best example for this came from OpenAI itself, when its own models accidentally hacked Hugging Face and other services after weeks of agentic scheming on internal message boards.

Daybreak is meant to give defenders a head start. The program now has two access tiers. Daybreak Blue gives users access to GPT-5.6 Sol with tailored safeguards for authorized defense work like vulnerability detection, malware analysis, and incident response. Daybreak Red targets security researchers doing vulnerability research, exploit validation, and penetration testing.

Getting into either tier requires identity verification, account security measures, monitoring, and legal declarations. Hardware security keys become mandatory for all Daybreak accounts on September 1, 2026. OpenAI also recommends running security workflows in isolated sandbox environments and using Auto-Review mode in Codex, which checks actions that need elevated privileges before they run.

GPT-5.6-Cyber answers 95 percent of sensitive security queries that other models block

The new GPT-5.6-Cyber model is available through the Daybreak Red tier. It's based on GPT-5.6 Sol and was specifically trained to perform better on tasks like finding zero-day vulnerabilities and building exploit chains. According to OpenAI, the model rarely refuses security-related queries that other models block by default.

GPT-5.6-Cyber answers 95 percent of sensitive cybersecurity queries in an internal benchmark. The standard GPT-5.6 Sol model blocks nearly all of them due to its safeguards. | Image: OpenAI

In an internal benchmark called "Advanced Cybersecurity Completion Rate," GPT-5.6-Cyber answers 95 percent of queries covering scenarios like exploit chain development, authentication bypass, and privilege escalation. GPT-5.6 Sol with safety measures turned on hits just 1.5 percent. With Daybreak Blue, it reaches 2 percent. The previous model, GPT-5.5-Cyber, manages 57.3 percent.

In one specific test, the models had to develop a WebSocket authentication bypass for an internal admin panel. Only GPT-5.6-Cyber on Daybreak Red produced working exploit code. Every other variant refused to respond. On ExploitGym, a benchmark that measures how well models turn known vulnerabilities into working exploits, GPT-5.6-Cyber beats both GPT-5.6 Sol and GPT-5.5-Cyber.

The model already found two unknown Chrome vulnerabilities

OpenAI has also used GPT-5.6-Cyber for real-world vulnerability research. The company says the model analyzed V8, Chrome's JavaScript engine, and found two previously unknown vulnerabilities that can be chained together to corrupt memory and bypass the V8 heap sandbox. Google fixed the flaws after coordinated disclosure and assigned them the CVE-2026-15903 designation.

GPT-5.6-Cyber also reportedly found at least five vulnerabilities in a "popular mobile operating system." One of them is a chain of flaws that would let an app escalate its normally restricted access rights to full administrator privileges, taking control of the device. OpenAI is working with Daybreak partners and the open-source community to disclose and fix these issues.

Under OpenAI's Preparedness Framework, GPT-5.6-Cyber has been rated "High" for cybersecurity capabilities but doesn't reach the "Critical" threshold. The recently announced Astra model is "potentially" expected to hit that Critical level, though. Given that GPT-5.6-Cyber is already a specialized, optimized model and still falls short of Critical, the trajectory is clear: AI cyber capabilities are climbing fast with each new generation.