OpenAI says Astra is its first model at the Critical cybersecurity level

OpenAI has classified Astra, a model it has not yet released, at the Critical cybersecurity level under its Preparedness Framework. The company published the assessment in a post called "Path to Astra: critical capabilities and frontier safeguards" on 1 September 2026. It is the first time OpenAI has placed any of its models at that level for cybersecurity.

What the classification means

OpenAI defines the Critical threshold for cyber capability as a model that can, in its words, "identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems" or "devise and execute end-to-end novel strategies for cyberattacks." The distinction from earlier models is that Astra does this without step-by-step human direction.

The numbers OpenAI reports are its own internal testing, so read them as the company's claims rather than independent results. OpenAI says Astra scored 100% on ExploitBench, a benchmark for building working exploits from vulnerabilities that are already known. On a separate internal test covering 20 high-severity V8 vulnerabilities disclosed between June and August 2026, the company says the model found two previously unknown zero-day vulnerabilities and used them as part of an exploit chain. OpenAI also says expert assessors watched it produce browser-compromise chains and local privilege-escalation exploits.

The safeguards OpenAI attaches

OpenAI says Astra refuses 91.5% of cyber jailbreak attempts, against 59% for GPT-5.6 Sol, and that in alignment testing the model made no attempts to compromise honeypot systems. The company says it monitors the chain of thought and runs classifiers to detect misalignment. On that basis it judges that the safeguards "sufficiently minimize the risk of severe harm for release."

Release is staged. OpenAI writes that access for advanced cybersecurity workflows "will initially be available to a small group of alpha testers, with access through Daybreak Blue expanding afterward to support defensive use." No general availability date is given.

Offence arrives before defence

The immediate effect is uneven, and worth being plain about. The capability described here is a model that reads a codebase and finds flaws nobody has reported yet. Defensive access to it is limited to an invitation programme most teams will not be in. So the sensible planning assumption is that attackers will use this capability against your dependencies before your team can use it for defence.

So use that time on routine security work rather than waiting for a tool. Know which dependencies you actually include, keep the path from a disclosed CVE to a deployed patch short enough to measure, and treat the time between publication and your own rollout as the number that matters. None of that is new advice. What changes is how quickly a flaw is likely to be turned into a working attack after it exists.

It is also worth remembering where these figures come from. Every measurement above is OpenAI grading its own model on its own benchmarks, published ahead of a release that has no date. Nobody outside the company has checked them yet.

Source

Primary source: OpenAI, Path to Astra, 1 September 2026. Coverage: CNBC, 1 September 2026.