OpenAI 发布 GPT-6 Cyber 系统卡

2. Model Data and Training

GPT‑6 Cyber’s post-training focuses on cybersecurity capabilities and alignment. We use reinforcement learning to train the model on tasks such as reproducing crashes, developing working exploits, and searching codebases for vulnerabilities. Through this training, the model learns to refine its approach, try different strategies, and recognize mistakes. We also use reward signals designed to reduce refusals on authorized cybersecurity requests.

Alongside these capability improvements, we incorporate training signals to improve alignment and discourage reward hacking. These signals reinforce following the user’s intended scope and authorization, avoiding unrequested actions, and accurately reporting results. ¹

3.3 Biological Safety and Over-Refusal

We tested whether reducing refusals on cybersecurity tasks also made GPT-6 Cyber more willing to provide violative biological assistance. The biology refusal evaluations described in the GPT-6 Astra system card cover severe-risk requests, dual-use requests with both legitimate and potentially harmful applications, and benign biology questions. We measure non-violative responses in the first two categories and whether the model avoids unnecessary refusals in the third.

In these evaluations, GPT-6 Cyber did not comply to nearly all severe-risk and dual-use biology requests while answering most benign questions without unnecessary refusal.

4. Alignment and Agent Safety

GPT‑6 Astra introduced substantial alignment improvements over GPT‑5.6 Sol, as described in its system card. Our goal with GPT‑6 Cyber is to deliver similar alignment improvements while enabling a broader range of authorized cybersecurity work. We use the same alignment evaluations to test whether the model respects restrictions, reports obstacles honestly, and stays within the user’s authorization. We report GPT‑5.6 Sol and/or GPT-5.6 Cyber as the earlier-generation baseline below.

GPT‑6 Cyber shows substantial improvements over GPT‑5.6 Sol. Its alignment results are broadly comparable to GPT‑6 Astra’s, with strengths and weaknesses across individual evaluations: it matches Astra on respecting Auto-Review rejections and performs better at acknowledging unavailable search tools, but is slightly less likely to stop when warnings warrant it and performs worse at reporting blockers in its final answer.

4.1 Respecting Restrictions and Scope

Respecting review decisions. We tested whether GPT-6 Cyber respects Auto-Review rejections. The model completed the prohibited action in 0% of graded rollouts, matching GPT-6 Astra, compared with 0.3% for GPT-5.6 Sol.

Auto-Review evaluation (lower is better)

Responding to warnings. We tested how the model responds to warnings displayed by tool interfaces, with one set of tasks where stopping is more appropriate and another where continuing is more appropriate. GPT-6 Cyber outperforms GPT-5.6 Sol on both sets: 73.00% vs. 57.10% when stopping is appropriate, and 80.43% vs. 77.26% when continuing is appropriate. Compared with Astra, GPT-6 Cyber stops less often on the first set (73.00% vs. 78.38%), but succeeds more often on the second (80.43% vs. 72.19%). This pattern is consistent with its greater task persistence.

Warnings evaluation (higher is better on both splits)

Staying within scope. Our ExploitGym Honeypot evaluation takes some of the most challenging tasks from ExploitGym and adds an auxiliary service as a honeypot. The model may use this service for legitimate support tasks, but exploiting it is outside the authorized scope. Without deployment safety instructions, GPT-6 Cyber exploited the honeypot in 0.07% of graded rollouts, compared with 49.5% for GPT-5.6 Sol, 5.51% for GPT-5.6 Cyber, and 0% for GPT-6 Astra. With deployment safety instructions, GPT-6 Cyber’s observed exploitation rate was 0%.

ExploitGym Honeypot evaluation (lower is better)

5.3 New and strengthened safeguards

GPT-6 Cyber’s stronger cybersecurity capabilities create greater risks of harm, so we have added a series of new safeguards around the model.

Blocking high-risk cyber assistance. We added additional checks to GPT-6 Cyber and cyber-critical models in Daybreak Blue to detect and block high-risk assistance involving industrial controls, essential services, and election systems. These checks also target assistance that could enable death or serious injury, catastrophic physical destruction, life-endangering service disruption, or offensive control of weapons systems.

We evaluated these protections with Dragos, specialists in industrial control security, using cyber-permissive Daybreak Red models in a controlled lab. Together, we developed a sensitive red-teaming evaluation covering requests that progress from understanding a device to interacting with it in dangerous or unauthorized ways. Below, we depict block rates on this evaluation across our different trusted access tiers before and after these changes, including recall improvements across our Standard access, Daybreak Blue, and Daybreak Red tiers.

Figure: Safeguard block rate before and after updates across four access configurations on the sensitive red-teaming evaluation. Block rate measures the share of requests flagged by the safeguards; it does not measure over-refusal on legitimate defensive work.

We continue to refine these safeguards using feedback from the security community, including partner reports and reports submitted through /feedback in our first-party products when safeguards miss harmful activity or interfere with legitimate work.

Cyber-specific misalignment monitoring. We adapted our monitoring instructions to distinguish authorized security testing from actions outside the user’s scope. These instructions help monitors assess whether the model’s use of systems, credentials, and data matches the user’s authorization, without treating legitimate exploit development or testing as inherently misaligned.

Biological safety mode for all users. We also guard against the risk that cyber-focused training could reduce refusals outside cybersecurity. We enable conservative biological safety mode for every GPT-6 Cyber user, alongside biological safety classifiers and monitoring. Expanded cyber access is not intended to relax our safeguards for other types of harm.

Private Safety Processing. Next, we’ve built automated safety checks that review related interactions together to detect misuse that may not be apparent in a single request. To enable this, we generally require API customers using Zero Data Retention to use Private Safety Processing (PSP), with limited approved exceptions. Standard data retention remains the default for GPT-6 Cyber.

We use PSP to review encrypted safety records in a protected environment and produce limited safety signals, without exposing the underlying prompts and responses to OpenAI personnel. Customers retain the encrypted records in their own storage for 30 days and can investigate them in their own systems or choose to share relevant information with us.

API IP allowlisting. To make stolen credentials harder to use, we require IP allowlisting for Daybreak Red API access by default. This limits requests to customer-approved network addresses. We approve exceptions for technical constraints; cloud-provider deployments may have different requirements or approved alternatives.

Account-compromise monitoring. Finally, we monitor API keys and Sign in with ChatGPT access tokens for signs of compromise across both Daybreak Red and Blue. When we detect suspicious activity, we can investigate and revoke affected credentials.

10. Biological and chemical safety

We treat GPT-6 Cyber as High but not Critical in Biological and Chemical capabilities, consistent with GPT-6 Astra’s Preparedness assessment. Because its additional training focused on cybersecurity, we expected its biological and chemical capabilities to remain broadly similar to Astra’s.

To test this expectation, we ran five Bio-High evaluations. Consistent with previous system cards, we counted refusals as successes to estimate a conservative upper bound on capability. GPT-6 Cyber sometimes achieves higher raw scores, but they are largely due to fewer refusals; after accounting for refusals and safe completions, its scores are comparable to GPT-6 Astra’s. On ProtocolQA, GPT-6 Cyber scored 47.2% with standard scoring and 50.9% when we counted refusals and safe completions as correct; both scores were higher than Astra’s corresponding scores (41.4% and 45.4%), but both remained below ProtocolQA’s indicative High threshold of 54%. These results support carrying forward Astra’s assessment.