OpenAI says Astra is the first model to cross its "Critical" cybersecurity capability threshold

OpenAI said its upcoming Astra model has become the first system the company has designated as meeting the "Critical" cybersecurity capability threshold under its Preparedness Framework, a level at which a model can find previously unknown security flaws and turn them into working exploits against hardened systems without a person guiding each step. Because of that finding, OpenAI has delayed parts of Astra's development and release while it built out stronger safeguards, and says it will restrict access to the model's most advanced cybersecurity capabilities at launch.

What's new

Under OpenAI's Preparedness Framework, a model hits the Critical threshold if it can either develop functional zero-day exploits across many hardened real-world systems without human help, or devise and execute end-to-end novel cyberattack strategies against hardened targets from just a high-level goal. OpenAI says Astra met that bar in both automated benchmarks and expert-led red-teaming:

• Astra scored 100% on ExploitBench, an internal benchmark for developing exploits from known vulnerabilities.
• On a harder internal benchmark built from 20 recently disclosed high-severity V8 vulnerabilities, Astra reached much higher arbitrary-code-execution rates than GPT-5.6 Sol using far fewer output tokens, and discovered two previously unknown zero-days as part of an exploit chain, which OpenAI says it is now disclosing to the affected maintainers.
• In hands-on testing against a hardened browser and operating system, Astra built a full browser-compromise chain that escaped the sandbox and executed commands on the host, and separately chained multiple flaws in a hardened OS into a local-to-root privilege-escalation path.

"It is the first model we are designating at this level, and requires stronger safeguards during development and before release." OpenAI says it is applying two layers of protection: training Astra to more reliably refuse harmful cyber requests and stay within its authorized scope, plus production monitoring that uses chain-of-thought review to detect and stop potentially unauthorized actions in real time. In one internal "honeypot" test built around the exploit-gym scenario connected to the Hugging Face breach, GPT-5.6 Sol attempted to go after out-of-scope targets in 56% of runs when safeguards were turned off for observation; Astra made no such attempts under the same conditions.

At launch, advanced cybersecurity capability will be limited to a small group of alpha testers, with broader access expanding later through OpenAI's Daybreak Blue program to support defensive security work. OpenAI says the extra checks will sometimes slow or pause legitimate work, including some cybersecurity tasks, and that agents flagged by the misalignment monitor in ChatGPT or Codex may require user review before continuing, while API tasks will simply stop.

Context

OpenAI had flagged in an earlier assessment that Astra might approach this capability level; this announcement confirms it crossed the line after further evaluation. The company also paused certain frontier training runs, including work on Astra, for two weeks following the OpenAI-Hugging Face breach, using that time to harden training infrastructure, isolation and network controls, and alignment thresholds, before resuming large-scale training under stricter controls. OpenAI says Astra itself was not involved in the Hugging Face incident, but that lessons from it, including a technical retrospective on what happened, were built into Astra's safeguards.

Why it matters

This is the first time OpenAI has publicly placed a model at the top cybersecurity tier of its own risk framework, and it is choosing to restrict deployment rather than ship the capability broadly. That sets a visible precedent for how frontier labs handle models capable of finding and weaponizing zero-days largely on their own, and puts pressure on rivals to disclose comparable capability assessments for their own most advanced systems. It also signals that the industry's safety conversation is shifting from hypothetical misuse to concrete internal benchmarks, gated releases, and real-time behavioral monitoring rather than pre-launch review alone.