Sora 由 THE DECODER 提示生成
要点
- OpenAI 的新模型 GPT-6 Astra 比其前代 GPT-5.6 Sol 的幻觉更少，并能拦截 99.99% 的直接提示注入攻击。
- Astra 在抵御越狱攻击方面也更有效，但在多轮对话中，顽固的攻击者仍约有三分之一的几率能获得有问题的回答。
- 对于隐藏在 AI 所读取文档中的间接提示注入，Astra 的失败率从 27% 降至 8.5%。这是很大的进步，但比例仍然偏高。
OpenAI 的新模型 GPT-6 Astra 比其前代产品产生的幻觉更少，拦截提示注入攻击的效果也更好。但对于真正安全的 AI 智能体部署而言，它仍然不够可靠。
根据 OpenAI 的系统卡，新 Astra 模型比其前代 GPT-5.6 Sol 产生的事实性错误要少得多。OpenAI 使用用户标记为答案错误的 ChatGPT 对话对其进行了测试，这意味着这些是特别容易出错的案例，其失败率不应被视为日常使用的典型水平。Astra 重现这些已报告错误的频率要低得多，其中在低延迟设置和较低推理级别下取得的进步最大。
对于直接提示注入攻击——即用户试图通过自己的提示词操纵模型——Astra 实现了近乎完美的 99.99% 防御率。OpenAI 将此归功于其 GPT-Red 方法，该方法在训练期间使用自动化攻击者来强化模型。
越狱防御的表现也类似。针对一组固定的已知攻击数据集（这些攻击试图获取关于生物学、暴力和网络安全的有害回复），Astra 在 91.5% 到 98.3% 的情况下拒绝提供帮助。
当攻击者在多轮对话中调整策略时，Astra 的防御率降至约 67%，这意味着顽固的对手大约每三次尝试就能诱出至少一条有问题的回复。前代模型在同一测试中的得分略低于 50%。OpenAI 指出，这些测试是在裸模型上运行的，没有搭载实际产品中附带的生产级安全层（如分类器）。
隐藏的提示注入仍然是一个真实的安全问题
Astra 在间接提示注入方面取得了进展，这类攻击隐藏在 AI 读取的文档中。安全公司 Gray Swan 的外部测试使用了来自其 IPI Arena 的 1,810 个精选攻击，结果显示，在每种场景尝试 15 次的情况下，Astra 在 8.5% 的情况下至少被攻破一次。GPT-5.6 Sol 在 27% 的情况下失败。Claude Opus 5 在同一评估中表现更好，失败率为 4.8%，但它也并非完全免疫。
Gray Swan 将第一季度和第二季度测试合并后的数据，与早期结果相比实际上有所上升。Anthropic 此前仅基于难度较低的 Q1 测试报告了 2% 的攻击成功率，而 GPT-5.6 Sol 在该测试中的得分也只有 20%。Anthropic 还在所有模型上开启了扩展推理功能，再加上测试范围更广，这或许可以解释两者之间的差距。
尽管这些都是经过精心挑选的攻击场景，但这样的成功率足以让任何企业安全团队感到担忧。Astra 大约每十二个场景中就会有一个因注入指令而被攻破。Opus 5 的表现更好一些，但大约每二十一个场景中仍会出现一次失败。而且风险还在不断增长。AI 智能体正越来越多地自主编写代码、操作工具和控制计算机，这正是 Gray Swan 所测试的内容。这些智能体还被设计为全天候、大规模运行，而阅读和处理文档正是它们的核心工作之一。
GPT-6 系统卡
Sora prompted by THE DECODER
Key Points
- OpenAI's new model GPT-6 Astra hallucinates less than its predecessor GPT-5.6 Sol and blocks 99.99 percent of direct prompt injection attacks.
- Astra also resists jailbreaks more effectively, but persistent attackers can still get a problematic response about one in three tries over multiple conversation rounds.
- For indirect prompt injections hidden inside documents the AI reads, Astra's failure rate dropped from 27 percent to 8.5 percent. That's a big improvement, but it's still high.
OpenAI's new model, GPT-6 Astra, produces fewer hallucinations and blocks prompt injection attacks more effectively than its predecessors. But it still isn't reliable enough for truly secure AI agent deployments.
The new Astra model makes far fewer factual errors than its predecessor, GPT-5.6 Sol, according to OpenAI's system card. OpenAI tested it against ChatGPT conversations that users had flagged for wrong answers, meaning these were particularly error-prone cases whose failure rates shouldn't be taken as typical for everyday use. Astra reproduced these reported errors much less often, with the biggest gains showing up at low latency settings and lower reasoning levels.
For direct prompt injections, where users try to manipulate the model through their own prompts, Astra hits a near-perfect 99.99 percent defense rate. OpenAI credits its GPT-Red method for this, which uses an automated attacker to harden the model during training.
Jailbreak resistance looks similar. Against a fixed dataset of known attacks trying to extract harmful responses about biology, violence, and cybersecurity, Astra refuses to help in 91.5 to 98.3 percent of cases.
When attackers adapt their strategy over multiple conversation rounds, Astra's defense rate drops to about 67 percent, meaning persistent adversaries can coax out at least one problematic response roughly one in three tries. Predecessor models scored just under 50 percent on the same test. OpenAI notes that these tests ran on the bare model without the production safety layers like classifiers that ship with the actual product.
Hidden prompt injections remain a real security problem
Astra makes progress on indirect prompt injections, where an attack is buried inside a document the AI reads. External testing by security firm Gray Swan, using 1,810 curated attacks from their IPI Arena, found that with 15 attempts per scenario, Astra was cracked at least once 8.5 percent of the time. GPT-5.6 Sol failed 27 percent of the time. Claude Opus 5 did better at 4.8 percent in the same evaluation, but it wasn't immune either.
The numbers in Gray Swan's combined Q1 and Q2 test actually went up compared to earlier results. Anthropic previously reported only a two percent attack success rate based on the easier Q1 test alone, and GPT-5.6 Sol scored just 20 percent there too. Anthropic also ran all models with extended reasoning turned on, which, alongside the broader test scope, could explain the gap.
Even though these are curated, hand-picked attacks, the success rates should worry any enterprise security team. Astra can be tricked through injected instructions in roughly one out of every twelve scenarios. Opus 5 holds up better, but it still fails about one in twenty-one. And the risk is growing. AI agents are increasingly writing code, operating tools, and controlling computers on their own, which is what Gray Swan tested. These agents are also being built to run around the clock and at scale, with reading and processing documents as one of their core jobs.
GPT-6 System Card