GPT-5.6-Cyber評測：OpenAI資安模型完成率飆至95% | GPT-5.6-Cyber Review: OpenAI Hacking AI Hits 95%

By Kit 小克 | AI Tool Observer | 2026-08-14

🇹🇼 GPT-5.6-Cyber評測：OpenAI資安模型完成率飆至95%

GPT-5.6-Cyber是OpenAI在2026年8月10日推出的資安專用模型，透過名為Daybreak Red的受控存取管道開放給通過審核的資安研究員，用來做漏洞研究、滲透測試與弱點驗證。OpenAI表示GPT-5.6-Cyber在進階資安任務上的完成率高達95%，相較一般版GPT-5.6 Sol只有1.5%——因為這個模型被刻意訓練成「拒絕較少」，能配合高風險、雙重用途的任務。

GPT-5.6-Cyber是什麼？

GPT-5.6-Cyber是基於GPT-5.6 Sol微調出來的專用模型，鎖定找零時差漏洞（zero-day）、串接漏洞鏈（exploit chain）等進階資安工作。跟一般ChatGPT不同，它拿掉了大部分會攔截資安相關請求的系統過濾器，讓授權使用者能直接問「怎麼寫這段程式的漏洞利用」而不會被打回票。

Daybreak Blue跟Daybreak Red差在哪？

OpenAI把資安存取分成兩層：Daybreak Blue給一般防禦端研究員用一般版GPT-5.6 Sol，但拿掉攔截資安請求的過濾器，完成率約2%；Daybreak Red才是唯一能碰到GPT-5.6-Cyber的管道，門檻更高、審核也更嚴，完成率直接衝到95%。兩層制度的用意很明顯：把「有能力做壞事」的工具鎖在最小可信範圍內。

GPT-5.6-Cyber真的找到漏洞了嗎？

有，而且是真的。OpenAI用GPT-5.6-Cyber在Chrome的JavaScript引擎V8裡挖出兩個先前未知的漏洞，串起來可以破壞記憶體、逃出V8的heap沙盒——這種等級的漏洞鏈在資安圈屬於「高段」操作，過去多半要頂尖研究員花數週手動挖掘。

雙重用途風險怎麼辦？

OpenAI自己的Preparedness Framework把整個GPT-5.6系列列為資安風險「高」等級——意思是這模型有能力對關鍵基礎設施攻擊提供實質助力，或自主找到並利用正式環境的漏洞。為了壓低風險，OpenAI加了硬體金鑰驗證、Codex裡的自動審查機制，以及使用行為監控，但業界對「拒絕率降低」本身還是有疑慮：畢竟資安攻防技能本來就是一體兩面。

小克怎麼看

對一般開發者來說，GPT-5.6-Cyber短期內碰不到——它只開放給通過嚴格審核的資安研究員，不是公開API。但這件事的訊號很清楚：AI模型正式進入「主動找漏洞」的階段，而且效果已經不是玩具等級（V8沙盒逃脫是真材實料）。對企業資安團隊，這代表防禦端也該開始評估用AI輔助滲透測試；對一般人，這代表攻擊面的AI化速度可能比防禦端更快，值得持續關注OpenAI跟其他廠商後續怎麼收緊或放寬存取政策。

好不好用，試了才知道。

🇺🇸 GPT-5.6-Cyber Review: OpenAI Hacking AI Hits 95%

GPT-5.6-Cyber is OpenAI's dedicated cybersecurity model, launched August 10, 2026 and available only through a vetted access program called Daybreak Red for authorized vulnerability research, exploit validation, and penetration testing. OpenAI says GPT-5.6-Cyber completes 95% of advanced cybersecurity tasks, compared to just 1.5% for the standard GPT-5.6 Sol with safety filters active — because this model was deliberately trained to refuse less on high-risk, dual-use requests.

What Is GPT-5.6-Cyber?

GPT-5.6-Cyber is a fine-tuned version of GPT-5.6 Sol built specifically for finding zero-day vulnerabilities and chaining exploits. Unlike consumer ChatGPT, it strips out most of the system-level filters that normally intercept security-related requests, letting vetted users ask for working exploit code without getting refused.

Daybreak Blue vs. Daybreak Red: What's the Difference?

OpenAI split cybersecurity access into two tiers. Daybreak Blue gives defenders access to standard GPT-5.6 Sol with filters removed, hitting about 2% completion on advanced tasks. Daybreak Red is the only route to GPT-5.6-Cyber itself, with tighter vetting and that 95% completion rate. The two-tier structure is designed to keep the most capable tool locked to the smallest trusted circle.

Did GPT-5.6-Cyber Actually Find Real Vulnerabilities?

Yes. OpenAI used GPT-5.6-Cyber to discover two previously unknown vulnerabilities in V8, Chrome's JavaScript engine, that could be chained together to corrupt memory and escape V8's heap sandbox — the kind of exploit chain that normally takes elite researchers weeks of manual work.

What About Dual-Use Risk?

OpenAI's own Preparedness Framework rates the entire GPT-5.6 family "High capability" for cybersecurity risk — meaning the model can meaningfully help attackers against critical infrastructure or autonomously exploit production systems. To offset that, OpenAI added hardware security keys, auto-review inside Codex, and usage monitoring. Critics still note that lowering refusal rates on offensive-security tasks cuts both ways: the skills that help defenders are the same skills that help attackers.

Kit's Take

Most developers won't touch GPT-5.6-Cyber anytime soon — it's gated behind strict vetting, not a public API. But the signal is clear: AI models are now actively hunting for vulnerabilities, and the results are no longer toy-grade — a real V8 sandbox escape is serious work. Security teams should start evaluating AI-assisted pentesting on the defense side, because the offense side is clearly already there.

好不好用，試了才知道。

Sources / 資料來源

常見問題 FAQ

GPT-5.6-Cyber一般人能用嗎？

不行，僅限通過OpenAI審核的資安研究員透過Daybreak Red存取，沒有公開API或消費版。

GPT-5.6-Cyber跟一般GPT-5.6差在哪？

GPT-5.6-Cyber拿掉大部分資安請求的拒絕機制，進階資安任務完成率達95%，遠高於一般版的1.5%。

Daybreak Blue和Daybreak Red有什麼不同？

Daybreak Blue給防禦端研究員用一般模型但拿掉過濾器，完成率約2%；Daybreak Red才能存取專用的GPT-5.6-Cyber，審核門檻更高，完成率達95%。

GPT-5.6-Cyber真的發現漏洞了嗎？

是的，OpenAI用它在Chrome的V8引擎中找到兩個可串接、能逃出heap沙盒的先前未知漏洞。

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士