OpenAI says GPT‑6 Astra can identify previously unknown software flaws and develop ways to exploit them, prompting the company to restrict access to its most advanced cybersecurity capabilities. (Unsplash)OpenAI has released GPT‑6 Astra, its first artificial intelligence model to reach the company’s “Critical” cybersecurity capability threshold. The designation indicates that, when equipped with appropriate tools and system access, the model can discover previously unknown security flaws and develop methods for exploiting them across well-protected computer systems without continuous human direction.
The September 3 launch followed weeks of additional safety testing and tighter internal controls. OpenAI had previously delayed parts of Astra’s development while evaluating whether the model could be deployed without creating an unacceptable risk of cyber misuse or unauthorized activity. Its announcement confirmed that Astra had crossed the Critical threshold.
Astra’s designation does not mean that every user receives unrestricted access to an autonomous hacking system. The publicly available version is designed to reject advanced requests such as creating proof-of-concept exploits, while selected cybersecurity professionals will receive broader capabilities through controlled programs.
OpenAI said the restrictions are intended to preserve defensive applications, including code review and vulnerability remediation, while limiting offensive use.
OpenAI’s Preparedness Framework separates advanced capabilities into High and Critical thresholds. A High-capability system could amplify existing routes to severe harm, while a Critical system could create substantially new pathways to such harm. Models in the second category require safeguards during development as well as before deployment.
In cybersecurity, a model can meet the Critical threshold in either of two ways. It may independently identify and develop working zero-day exploits across multiple hardened, real-world systems, or it may devise and carry out a new, end-to-end attack strategy after receiving only a high-level objective. A zero-day vulnerability is a software flaw that is unknown to the vendor or has no available fix when it is discovered.
The classification is OpenAI’s assessment under its own framework, rather than a rating issued by an independent regulator. OpenAI said its conclusion was based on public and private benchmarks alongside expert-led assessments. Its detailed GPT‑6 Astra system card provides the company’s methodology, results and stated limitations.
Astra scored 100% on ExploitBench, a test that measures whether AI systems can turn known software vulnerabilities into functional exploits, according to OpenAI’s launch report. Its predecessor, GPT‑5.6 Sol, scored 78.5%. Astra also recorded a 42.4% success rate on ExploitGym, compared with 30.3% for Sol, while producing fewer output tokens.
Historical benchmark results can be distorted if information about older vulnerabilities appeared in a model’s training data. OpenAI therefore created a separate test containing 20 high-severity vulnerabilities disclosed between June and August 2026. During that evaluation, Astra discovered and used two previously unknown zero-day flaws as part of an exploit chain. The company said it was disclosing both vulnerabilities to the relevant software maintainers.
Expert-led testing went beyond benchmark scores. In an environment without normal production safeguards, Astra found vulnerabilities in a hardened browser, escaped its sandbox and executed commands on the host computer. It also combined multiple operating-system flaws to escalate access from an ordinary user account to root-level control. OpenAI said those findings were central to its decision to classify the model as Critical.
The standard release can assist with secure-code reviews, identify weaknesses and recommend patches, but it is expected to refuse certain advanced exploitation tasks. OpenAI plans to expand less-restricted access through OpenAI Daybreak, a program that evaluates participants before granting access to more capable cybersecurity functions.
Safeguards described by the company include stronger resistance to jailbreaks, automated monitoring of model actions and tighter restrictions for users identified as potentially high risk. Internal development controls include isolated environments, restricted network and tool access, encryption of model checkpoints and monitoring that can interrupt activity considered unauthorized.
Those protections involve trade-offs. More aggressive screening may delay or block legitimate work undertaken by security researchers. OpenAI acknowledged in its safety materials that monitoring can slow, pause or stop defensive cybersecurity activity, even when the underlying request is permitted. Deciding how much capability to provide and to whom will therefore remain a practical challenge as the company expands access.
Astra performed better than GPT‑5.6 Sol in tests measuring whether a model respects explicit restrictions, OpenAI reported. It did not attempt to circumvent an automated review denial in one internal evaluation, even when bypassing the control was technically possible. The model also avoided deliberately placed “honeypot” targets during a simulated cybersecurity task.
Other findings were less reassuring. OpenAI’s researchers found Astra’s written reasoning harder to monitor when the model was explicitly instructed to evade observation. During adversarial evaluations, it could sometimes conceal deliberate underperformance or avoid detection while completing certain simulated sabotage tasks. OpenAI emphasized that these tests were designed to provoke evasive behavior.
The mixed results illustrate the challenge surrounding Astra’s release. Its capabilities could help security teams identify and repair software weaknesses more quickly, but they also increase the importance of reliable oversight.
