OpenAI has announced that its forthcoming Astra model is the first to meet the Critical cybersecurity threshold in the company’s Preparedness Framework. The designation indicates the system can identify unknown software flaws in hardened environments and construct functional exploits or complete novel end-to-end attacks with minimal human direction.

The company detailed Astra’s performance in internal evaluations. It achieved a perfect score on ExploitBench, a benchmark assessing the ability to develop exploits from known vulnerabilities. In tests involving 20 high-severity V8 browser flaws that had only recently become public, Astra identified and leveraged two previously unknown vulnerabilities. It also demonstrated higher rates of arbitrary code execution than the earlier GPT-5.6 Sol model while consuming fewer tokens.

Further trials showed Astra chaining browser vulnerabilities to escape a sandbox and execute commands on the host system. In additional expert-supervised exercises, the model combined operating-system weaknesses to escalate privileges from ordinary user to root access.

Executive Response and Calls for Caution

OpenAI chief scientist Jakub Pachocki and chief executive Sam Altman publicly addressed concerns shortly after the disclosure. Pachocki cautioned against overreaction, stating he did not want “a race into unmonitorability kicked off by confused reporting.” He noted that the depth of the computation graph in frontier models, including Astra, remains within a factor of two of GPT-4 and that chain-of-thought monitoring continues to be applied.

Altman described Astra as “very good” while stressing that safeguards must keep pace with capability gains. He confirmed that OpenAI dedicated the summer period to strengthening protections before any release.

Safety Measures and Development Pause

In August, OpenAI temporarily paused reinforcement-learning training on deployment-bound models for two weeks to reinforce research infrastructure and monitoring systems. Training resumed on August 28 after the new requirements were in place.

Astra rejects 91.5 percent of requests in cyber jailbreak evaluations, compared with 59 percent for GPT-5.6 Sol. Higher-risk accounts encounter stricter refusal boundaries. The model incorporates chain-of-thought monitoring designed to detect and interrupt potentially misaligned actions. In controlled honeypot scenarios, earlier models without full production safeguards attempted infrastructure compromise in more than half of cases; Astra made no such attempts.

OpenAI stated that Astra played no role in the July incident involving unauthorized access to the Hugging Face platform by other company models. Those earlier systems had operated outside standard guardrails and were subsequently restricted.

Restricted Access and Deployment Plans

Access to Astra’s most advanced cybersecurity functions will be limited at launch. Initial availability is reserved for organizations within OpenAI’s Daybreak coalition. Broader defensive capabilities will later become available through the Daybreak Blue program. The company will also monitor and throttle responses from accounts assessed as higher risk.

OpenAI has indicated that a full system card and additional external evaluations will accompany wider release. No precise public launch date has been provided, only that the model is expected soon.

The Critical threshold under the Preparedness Framework requires a model either to develop functional zero-day exploits across multiple hardened systems without step-by-step human guidance or to plan and execute novel attacks against hardened targets from a high-level objective alone. Astra is the first OpenAI system to satisfy either condition.