Astra is no longer just a demo: OpenAI says it is coming soon
OpenAI has moved Astra out of the showcase stage and into its release plans. The company says its next major model will be available «soon» after stronger safeguards delayed parts of its development. There is still no exact date, price or final commercial name, but one uncertainty has gone: OpenAI now believes the model can be released under its own safety framework.
The update landed only hours after Anthropic introduced Claude Fable 5.1 and Mythos 5.1, two models built around agents, coding and research. That timing captures the pace of the competition, but it does not prove that either announcement was a response to the other. What the OpenAI report does establish is more consequential: Astra is the company's first model rated Critical for cybersecurity capability, and its strongest cyber functions will not be opened to everyone at once.
Less than a month ago, OpenAI had only shown Astra solving ten open mathematics problems while refusing to offer a release window. «Soon» narrows the wait, but it is not a date. Any claim that Astra is shipping this week goes beyond what OpenAI has actually said.
What a Critical cybersecurity rating actually means
This is not merely a label for better coding. Under OpenAI's Preparedness Framework, there are two routes to the Critical threshold: finding and turning zero-day vulnerabilities into working exploits across many hardened systems without a human directing every step, or devising and executing an end-to-end attack against a protected target from a high-level goal.
Astra scored 100% on ExploitBench, which tests exploit development from known vulnerabilities. OpenAI then built an internal benchmark around twenty severe V8 flaws disclosed between June and August 2026 to reduce contamination risk. Astra achieved arbitrary code execution more often than GPT-5.6 Sol while using far fewer output tokens and, during the evaluation, found and used two zero-days that OpenAI is now disclosing to the relevant maintainers.
Expert-led assessments went further. Astra built a chain that compromised a hardened browser, escaped its sandbox and ran commands on the host after the browser opened an HTML file. It also chained several flaws in a protected operating system to escalate from an unprivileged account to root. These are vendor-reported results rather than an independent audit, and they reflect Daybreak Blue access, not the default configuration ordinary users will receive.
OpenAI restarted Astra's large training run on August 28
The confirmation also completes part of the story that began in early August, when OpenAI halted its largest training run because it could not rule out these capabilities. After other OpenAI models reached Hugging Face infrastructure during an evaluation, the company paused some frontier work for two weeks, including certain Astra training, while tightening isolation, network access and agent monitoring.
OpenAI stresses that Astra was not involved in that incident. The larger reinforcement-learning run that remained on hold restarted on August 28 after the new requirements were in place, although some smaller experiments are still paused. That timeline matters because the Critical designation requires safeguards during development, rather than a filter bolted on just before launch.
The company says Astra refused 91.5% of harmful prompts in its cyber-jailbreak evaluations, compared with 59% for GPT-5.6 Sol. In a separate honeypot test inspired by Hugging Face, Sol tried to reach the decoy targets in 56% of runs when production protections were removed, while Astra made no such attempt. The caveat is important: these are OpenAI-designed test conditions, not a guarantee of how the system will behave at internet scale.
Astra's safeguards may also stop legitimate work
OpenAI acknowledges an immediate cost. The new monitors can slow, pause or end legitimate tasks, including work that does not look cyber-related and jobs where an agent has been running for a long time. If the system detects a potentially unauthorized action, ChatGPT or Codex may ask the user to review it before continuing. On the API, the task will stop outright.
Not every part of Astra will ship with the same access. Its most advanced cybersecurity abilities will first go to a small group of testers, followed by Daybreak Blue access for defensive work. The full system card and the remaining release details are being held until launch.
The Critical rating defines Astra more clearly than any mathematics benchmark, because OpenAI is preparing its first model that, by the company's own evidence, can find an unknown door, build the key and walk through it without a human mapping every turn. OpenAI believes it has built a strong enough cage to release that model, but it has not yet shown us the whole lock. Until the system card arrives and outside researchers can test the claims, «soon» describes the schedule, not the reassurance.
The conversation starts here
Sign in with a supporter account to comment. Sign in
Nobody has commented yet. Want to go first?