Back in early August, the language was that Astra might reach the critical threshold. Now it’s official. On September 1, OpenAI stated that Astra meets the “Critical” tier for cybersecurity under its Preparedness Framework. That’s a first. The definition is stark: with the right tools and access, the model can find previously unknown zero-day flaws in many hardened real-world systems and build working exploits for them, with nobody guiding each step.
The evidence OpenAI cites is specific. Astra scores 100 percent on ExploitBench. Since that benchmark is now considered contaminated, OpenAI built an internal version with 20 recently disclosed high-severity V8 vulnerabilities from June through August. Astra beats GPT-5.6 Sol there too, and with far fewer tokens. Along the way, the model discovered two real zero-days during the evaluation and used them in an exploit chain. OpenAI is now disclosing those to the maintainers. In expert-led tests, Astra built a full browser compromise: open an HTML file, escape the sandbox, run commands on the host. It also chained multiple bugs in a hardened operating system into a local privilege escalation from unprivileged user to root.
One caveat matters here: those results reflect access through Daybreak Blue, the program for defenders. Not the default configuration regular users get.
OpenAI still plans to release Astra soon. The argument is that the safeguards are now good enough. Astra refuses 91.5 percent of requests in the cyber jailbreak tests, compared to 59 percent for GPT-5.6 Sol. Higher-risk accounts get a stricter boundary. And for the second danger, the model itself going off the rails, there’s chain-of-thought monitoring in production plus classifiers that automatically stop suspicious actions. In a honeypot test modeled on the Hugging Face incident, GPT-5.6 Sol without safeguards tried to attack surrounding systems in 56 percent of cases instead of solving its assigned task. Astra: zero attempts.
The timeline behind all this is telling too. The large reinforcement learning runs for future Astra versions had been paused for a while after the Hugging Face incident. On August 28, OpenAI restarted the big frontier RL run under new safety and security requirements for the training environment. Some smaller experimental runs remain on hold.
Then there’s the part that affects users directly. OpenAI says plainly that the safety checks will slow down legitimate work. The misalignment monitor may pause tasks that have nothing to do with cybersecurity, such as agents running for a long time. In ChatGPT and Codex, you’ll be asked to review the action. Over the API, the task simply stops. The advanced cyber capabilities go to a small group of alpha testers first, then to Daybreak Blue.
My take: this reads a lot like what Anthropic went through with Fable 5 and Mythos 5 in June. A model that’s too good at attacking, a public version with the handbrake on, and a program for vetted defenders. Both companies end up with the same architecture, apparently because nobody has found a better one. If you plan to work with Astra, expect interruptions. Anthropic took weeks to loosen Fable’s filters. OpenAI will have to walk the same road.
Sources: OpenAI: Path to Astra: critical capabilities and frontier safeguards