On September 1, OpenAI announced that Astra, its next-generation model, has reached the Critical cybersecurity capability threshold under the company’s Preparedness Framework. This is the first model to be ranked at this level. This means that given the proper tooling and access, Astra can discover previously unknown security vulnerabilities and develop exploits for them across multiple well-defended systems without step-by-step human guidance.
OpenAI stated that it had partially paused the development and release of Astra over the past few weeks to strengthen and test safeguards against cybersecurity abuse and unauthorized actions by the model. Following that process, the company believes current safeguards have sufficiently mitigated the risk of severe harm to permit a release under the framework.
On the published technical capabilities:
-
On ExploitBench, Astra achieved a perfect score of 100% in developing exploits from known vulnerabilities.
-
On a new internal benchmark (ExploitBench - Internal Port, comprising 20 recently disclosed critical-severity V8 vulnerabilities), Astra achieved a significantly higher arbitrary code execution rate than GPT-5.6 Sol while using far fewer tokens. During the evaluation, the model even autonomously discovered and utilized two zero-day vulnerabilities in an exploit chain—both of which are currently being disclosed to maintainers.
-
In expert evaluations against hardened browsers and operating systems, Astra constructed a complete browser exploit chain (breaking out of the sandbox and executing commands on the host upon opening an HTML file) and chained multiple operating system vulnerabilities to escalate privileges from an unprivileged user to root.
Note: The results reflect capabilities under Daybreak Blue access, not the default production configuration.
On safety and safeguards:
-
Astra refused 91.5% of cyber jailbreak attempts (compared to 59% for GPT-5.6 Sol); higher-risk accounts are subject to more conservative behavioral boundaries.
-
Chain-of-thought monitoring and classifier systems have been deployed to detect and automatically halt potential unauthorized activity.
-
Although Astra was not involved in the Hugging Face incident in July, OpenAI integrated lessons from that event and assessed that its production safeguards at the time would have been sufficient to prevent it.
-
On August 28, OpenAI resumed the large-scale RL run that had been paused following the incident, after completing new safety requirements.
Release plan: Astra will be rolled out soon, but access to its most advanced cybersecurity capabilities remains restricted—initially limited to a group of alpha testers, and later made available via Daybreak Blue for defensive purposes. OpenAI acknowledged that the safeguards may cause some legitimate workflows, including defensive cybersecurity, to be slowed down or mistakenly paused—a trade-off the company is willing to accept to prevent abuse.