跳到内容
现在

科技 · AI 漏洞利用测试

OpenAI 发布预告：漏洞利用得分达 77%，但比较尚未得到证实

据报道，这款未命名模型在 ExploitGym 上领先 GPT-6 Cyber 24.4 个百分点。测试条件和访问规则的缺失，限制了这一结果对防御人员的参考价值。

文字 阅读需 5 分钟 · 13 个来源

HeyDex

原语言视频

译自英文原文。

OpenAI 最新发布的网络安全预览显示，一款模型在将软件弱点转化为可用漏洞利用方面表现出色得多。但这项比较中最重要的部分仍然缺失：没有足够信息判断各模型是否接受了同等测试。报道所称的 77.0% 得分是一个重大主张，但还不是可复现的证据，无法说明该系统究竟强了多少。⁠1⁠2

BigGo Finance 和 Gizmodo Japan 报道称，OpenAI 展示了一个尚未命名、尚未发布的模型的结果，其得分高于现有网络安全专用模型 GPT-6 Cyber 的 52.6%。据称，Anthropic 的 Mythos 5.2 得分约为 38%，是口头提及的参考值，并未显示在图表上。这些是对展示结果的二手报道，并非经过独立审查的评估。⁠1⁠2

77.0%尚未发布模型据报的 ExploitGym 得分 12
52.6%GPT-6 Cyber 据报的 ExploitGym 得分 12
~38%Mythos 5.2 口头提及的参考得分 12

据 Gizmodo Japan 报道，演示最初比较了通用模型 GPT-6 Astra 和 GPT-6 Cyber。随后，一条红线出现在两者上方，代表下一代网络安全模型。现有报道材料并未确定 GPT-6 Astra 的数值结果；77.0% 这一数字属于尚未发布的系统，而非 GPT-6 Cyber。⁠2

77.0% 和 52.6% 之间相差 24.4 个百分点。这并非相对提升 24.4%，称其为约 25% 的增幅混淆了两种不同的衡量方式。同样，与 Mythos 近似参考值相比约为两倍的比例，也只适用于这些特定得分。它不能证明 OpenAI 的新模型在网络安全方面整体效能翻倍。⁠1⁠2

对活动时间的描述也需要谨慎。Gizmodo Japan 的日文报道将演示时间定在 2026 年 11 月 13 日凌晨。相关视频标题为「Cyber at the Frontier」，而非该报道中采用的倒装标题。视频标注的 11 月 10 日发布日期并不能证明演示何时举行；也没有可读的文字稿可直接核实其中有关基准测试的内容。⁠2⁠11

从漏洞到攻击

与单纯识别错误代码相比，ExploitGym 测试的是一种范围更窄、但后果更重大的技能。智能体会收到一段可触发漏洞的程序输入，然后尝试将其扩展成可用的漏洞利用。成功意味着造成具体的安全影响，例如未经许可访问文件或运行未经授权的代码。该基准测试的作者将漏洞本身与它可能促成的攻击区分开来。⁠12⁠13

这种区别对防御人员很重要。发现弱点后，现实中还要追问：有人实际能用它做什么？展示漏洞利用能力有助于确定哪些修复应优先处理。同样的能力也可能减少攻击者所需的工作量。这项预览中的任何内容都不能证明有组织遭到攻击；真正令人担忧的是，能力更强的漏洞利用构建系统可能促成什么。⁠13

ExploitGym 的原始说明于 2026 年 5 月 11 日作为预印本提交，尚未经过同行评审。文中介绍了 898 个实例，取自现实世界中的漏洞，涉及普通应用、Google 的 V8 JavaScript 引擎以及 Linux 内核（操作系统的核心）。研究人员改变了应用于这些实例的安全防护，并将各类配置封装在可复现的软件容器中。⁠12⁠13

这些设计选择并非无关紧要。漏洞利用取决于漏洞周围的防护措施和运行时条件，也取决于智能体对漏洞进行推理的能力。早期评估发现，漏洞利用仍然困难，但前沿智能体能够利用相当一部分受测漏洞；即便启用了广泛使用的防御措施，也仍有一定成功率。⁠13

在那项较早的评估中，Claude Mythos Preview 和 GPT-5.5 的最强配置分别生成了 157 个和 120 个可用漏洞利用。这些模型与新比较中的模型不同。无论是这些数量，还是原始基准测试中的 898 个实例，都不能确定 11 月百分比的分母。若要据此绘制进步曲线，必须先匹配任务和条件。⁠12⁠13

实际主张需要实际证据

相关报道还称，GPT-6 Cyber 发现了 81 个此前未知、严重程度较高的 Firefox 漏洞，并在一次运行中检查了约 1,000 个 Linux 漏洞，同时生成补丁。这些是关于现有专用模型的主张，并非对尚未发布模型的经验证结果。检查 Linux 漏洞并不意味着发现了 1,000 个新漏洞。⁠1⁠2

生成补丁也不代表修复已通过验证、获准采用或部署。现有报道没有提供相应的漏洞记录或补丁结果，供防御人员核实这些主张。拟议的修复仍须经过工程审查和测试，才能被视为成功修复。⁠1⁠2

Gizmodo Japan 对 OpenAI 防御工具演示的另一篇报道介绍了这一人工检查环节：AI 提出修改方案，由人员审查，然后系统应用获批的修复。这有助于区分产出安全工作与确认该工作可靠。它并非对 Firefox 或 Linux 相关数字的独立证实。⁠4

怎样才能让领先优势令人信服

缺失的评估细节远不止模型名称。新比较没有说明任务数量、基准测试版本、漏洞筛选方式或评分规则。模型的具体配置、提示词、工具、尝试次数限制、时间或算力预算也不清楚；各模型是否在相同条件下测试，同样未明。⁠1⁠2

多次运行和不确定性估计有助于判断所报告的差距是否稳定。污染控制措施则有助于确定模型此前接触测试材料是否影响了表现。缺少这些细节时，站得住脚的结论只是：据报道，该模型在基准测试中大幅领先；这并不代表其在现实世界安全领域已被测出全面优势。

这款未命名模型仍未发布。现有证据无法确定其公开发布时间、访问政策或具体防护措施。因此，下一项重要公告未必是更高的得分，而可能是一项可供他人审视的评估，以及相应的访问安排，说明 OpenAI 打算如何管理这种对防御者和攻击者都很有价值的能力。⁠1⁠2

来源12

在此处引用的来源中，ギズモード・ジャパン最先发布，比本报道播出早18小时。 随后还有4家媒体发布。
  1. ギズモード・ジャパン
  2. Yahoo!ニュース
  3. Google News Australia (AU:en)
  4. Geeksエンジニア＆コンカフェ経営者から学ぶ
  5. iyooo
  6. HeyDay News

7家媒体未注明日期：antenna.jpar5ivcool3c.comCuriousCatsIT業界あるあるまとめUnnamed channel

按媒体查看所有来源

来自 12 家媒体的 13 个来源· 引用最多的优先

播出原貌
  1. OpenAI previewed an unreleased AI model that turns software weaknesses into working exploits.
  2. The model reportedly scored 77.0 percent on ExploitGym, which tests whether AI can turn a supplied vulnerability into an exploit. That ability could help defenders prioritize repairs, and make attacks easier. How much stronger is it under comparable conditions, and who will get access?
  3. OpenAI's preview put an unnamed next-generation model above its existing cybersecurity specialist. The presentation first compared the general-purpose GPT-6 Astra with GPT-6 Cyber. Then a red line for the unreleased model appeared above them. The new model's 77.0 percent score is the figure driving the comparison.
  4. The presented scores were 77.0 percent for the unreleased model and 52.6 percent for GPT-6 Cyber. Anthropic's Mythos 5.2 was given an approximate 38 percent reference value verbally, separate from the displayed chart.
  5. The gap over GPT-6 Cyber is 24.4 percentage points. Calling that a 25 percent improvement would mix up two different measures. And the roughly two-to-one ratio against Mythos applies to these particular scores. It tells defenders about performance on this exploitation test, while broader cybersecurity work involves many other tasks.
  6. ExploitGym gives an agent an input that triggers a software vulnerability. The agent then tries to build a working exploit from it. Success means producing a concrete security impact, such as accessing a file without permission or running unauthorized code.
  7. A working exploit can show defenders which weakness needs fixing urgently. Finding a bug leaves a practical question about what someone could actually do with it. Demonstrating exploitation helps resolve that question. But the same capability can lower the barrier for attackers, so access controls become part of the security stakes.
  8. Subscribe to this channel as we follow the model's evaluation details and who will be allowed to use it.
  9. The original ExploitGym benchmark contained 898 instances drawn from real-world vulnerabilities. They covered ordinary applications, Google's V8 JavaScript engine, and the Linux kernel, the core of the operating system. Its description was submitted on May 11, 2026, as a preprint.
  10. Researchers varied the security protections around the vulnerable programs and packaged the configurations in reproducible software containers. Those are controlled environments that others can run again. Exploitation depends on the protections and runtime conditions surrounding a bug, as well as the agent's reasoning. The original study hasn't been peer reviewed.
  11. In that earlier evaluation, the strongest configurations produced 157 working exploits for Claude Mythos Preview and 120 for GPT-5.5. Those were different models. Comparing those counts with November's percentages would require matching the tasks and conditions first.
  12. The original 898 instances don't tell us how many tasks sit behind the new percentages. In the May evaluation, exploitation remained challenging, but frontier agents succeeded on a meaningful fraction of vulnerabilities. They also retained some success with widely used defenses enabled. That combination explains both the defensive promise and the risk.
  13. GPT-6 Cyber reportedly found 81 previously unknown, high-severity Firefox vulnerabilities. It also examined roughly 1,000 Linux vulnerabilities in one run and generated patches. Those claims concern the existing model, and examination of Linux vulnerabilities doesn't mean discovery of that many new flaws.
  14. Generating a patch still leaves engineers with work to do. They need to validate the fix before accepting and deploying it. The practical claims about GPT-6 Cyber don't come with vulnerability records or patch outcomes that would let defenders check those results. The unreleased model's stronger benchmark score also needs its own evaluation details.
  15. The new comparison leaves the test setup unclear. Defenders need to know which tasks counted, how success was scored, and whether models had equivalent tools and attempt limits. Repeated runs would help show how much the results vary.
  16. The presented figures show a substantial benchmark lead. Whether that translates into a comparable real-world defensive advantage is still unresolved. OpenAI also hasn't announced access arrangements or specific safeguards for this unnamed model. It remains unreleased, with no public release date.

译文更新于

近期播出