Why OpenAI rated Astra its first model with Critical cybersecurity capability

From the safety report to GPT-6 Astra's launch

Updated September 5. OpenAI announced GPT-6 Astra on September 3, after this article was first published. Our launch report covers access, pricing and its differences from Sol. This article explains the safety report that preceded that release.

On September 1, OpenAI said Astra was nearing release and identified it as its first model rated Critical for cybersecurity capability. Its technical report described a system able to discover unknown flaws and combine attacks without detailed instructions at each step. That rating does not mean every user receives access to those capabilities.

In August, OpenAI had shown Astra solving ten open mathematics problems without committing to a release window.

What a Critical cybersecurity rating actually means

This is not merely a label for better coding. Under OpenAI's Preparedness Framework, there are two routes to the Critical threshold: finding and turning zero-day vulnerabilities into working exploits across many hardened systems without a human directing every step, or devising and executing an end-to-end attack against a protected target from a high-level goal.

Astra scored 100% on ExploitBench, which tests exploit development from known vulnerabilities. OpenAI then built an internal benchmark around twenty severe flaws in V8, the engine that runs JavaScript in browsers such as Chrome, disclosed between June and August 2026 to reduce contamination risk. Astra achieved arbitrary code execution more often than GPT-5.6 Sol while using far fewer output tokens and, during the evaluation, found and used two zero-days, previously unknown vulnerabilities that OpenAI is now disclosing to the relevant maintainers.

Expert-led assessments went further. Astra built a chain that compromised a hardened browser, escaped the sandbox separating its activity from the rest of the computer and ran commands on the host after the browser opened an HTML file. It also chained several flaws in a protected operating system to escalate from an unprivileged account to root, gaining administrator-level privileges. These are vendor-reported results rather than an independent audit, and they reflect Daybreak Blue access, not the default configuration ordinary users will receive.

OpenAI restarted Astra's large training run on August 28

The confirmation also completes part of the story that began in early August, when OpenAI halted its largest training run because it could not rule out these capabilities. After other OpenAI models reached Hugging Face infrastructure during an evaluation, the company paused some frontier work for two weeks, including certain Astra training, while tightening isolation, network access and agent monitoring.

OpenAI stresses that Astra was not involved in that incident. The larger reinforcement-learning run that remained on hold restarted on August 28 after the new requirements were in place, although some smaller experiments are still paused. That timeline matters because the Critical designation requires safeguards during development, rather than a filter bolted on just before launch.

The company says Astra refused 91.5% of harmful prompts in its cyber-jailbreak evaluations, compared with 59% for GPT-5.6 Sol. In a separate honeypot test inspired by Hugging Face, Sol tried to reach the decoy targets in 56% of runs when production protections were removed, while Astra made no such attempt. The caveat is important: these are OpenAI-designed test conditions, not a guarantee of how the system will behave at internet scale.

Astra's safeguards may also stop legitimate work

OpenAI acknowledges an immediate cost. The new monitors can slow, pause or end legitimate tasks, including work that does not look cyber-related and jobs where an agent has been running for a long time. If the system detects a potentially unauthorized action, ChatGPT or Codex may ask the user to review it before continuing. On the API, the task will stop outright.

The report reserved the strongest cyber capabilities for limited testing and defensive Daybreak Blue access. Results obtained with those permissions do not automatically describe what the consumer configuration allows.