OpenAI's Astra Becomes the First Model to Hit Its 'Critical' Cybersecurity Threshold

OpenAI disclosed that its upcoming Astra model is the first it has ever designated as meeting the “Critical” cybersecurity capability threshold under its Preparedness Framework — a level defined by the ability to autonomously find and exploit unknown (“zero-day”) vulnerabilities in hardened real-world systems, or to devise and execute complete novel cyberattack strategies from just a high-level goal.

Details

• What Astra can do: it scored a perfect 100% on ExploitBench, discovered two previously unknown zero-day vulnerabilities in recent V8 vulnerabilities during internal testing, and in expert-led assessments built a full browser-compromise chain that escaped sandboxing and executed host commands, plus local privilege-escalation chains from unprivileged user to root
• Model-level safeguards: Astra refuses 91.5% of disallowed cyber-assistance requests, versus 59% for its predecessor GPT-5.6 Sol, alongside improved alignment training around respecting authorized scope
• System-level safeguards: safety classifiers to detect cyberabuse, chain-of-thought monitoring for misaligned actions, activation classifiers, expanded jailbreak coverage, and a 24/7 rapid-response program for investigating new threats
• Honeypot results: in simulated tests, Astra made zero attempts to compromise surrounding security infrastructure, compared to GPT-5.6 Sol attempting unauthorized access in 56% of cases
• Controlled rollout: OpenAI plans a limited initial release to alpha testers, with broader access to Astra’s most advanced cybersecurity capabilities gated through its “Daybreak Blue” program for defensive security work; legitimate work may occasionally get flagged or paused by the new safeguards

What happened next

OpenAI says it plans to release Astra soon with a full system card detailing its safety and security testing, following its August 28 restart of large frontier reinforcement learning runs after establishing new safety requirements — the same pause referenced in OpenAI’s earlier Hugging Face incident postmortem. The Critical designation marks a formal industry first under OpenAI’s own framework and sets a new bar for how the company gates access to its most cyber-capable models going forward.