OpenAI's Astra Becomes First Model to Cross 'Critical' Cybersecurity Threshold, Chains Two Zero-Days in Testing
OpenAI says its unreleased Astra model is the first to hit the 'Critical' cybersecurity tier of its Preparedness Framework, chaining two zero-days in testing.
Overview
OpenAI said this week that Astra, an unreleased model, has become the first system the company has ever classified at the “Critical” cybersecurity capability threshold under its Preparedness Framework, according to Decrypt and Security Boulevard. “We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework,” OpenAI wrote. “It is the first model we are designating at this level, and requires stronger safeguards during development and before release,” according to Decrypt.
What We Know
Under OpenAI’s Preparedness Framework, a model hits the Critical tier if it can independently develop functional zero-day exploits against many hardened real-world systems, or if it can plan and execute an entire cyberattack against a hardened target starting from nothing more than a high-level goal, according to Decrypt. Earlier OpenAI models, including GPT-5.6 Sol, topped out at the framework’s lower “high” tier, according to Decrypt.
On ExploitBench, a benchmark that tests whether a model can turn already-known software vulnerabilities into functioning exploits, Astra scored a perfect 100%, according to Decrypt and Security Boulevard. To guard against memorized answers inflating that score, OpenAI ran a second test using 20 high-severity vulnerabilities disclosed in mid-2026 — in Google’s V8 JavaScript engine, according to Decrypt. In that test, Astra found and chained together two previously unknown zero-day vulnerabilities, which OpenAI said it is disclosing to the affected maintainers, according to Decrypt and Security Boulevard. Astra also beat GPT-5.6 Sol on arbitrary code-execution rates while “using far fewer output tokens,” according to Decrypt and fonearena.
In hands-on red-team testing, Astra built a full compromise chain that broke out of a browser sandbox and ran commands on the host — in one case starting from nothing more than a malicious HTML file, according to Decrypt. Separately, it found multiple flaws in a hardened operating system and strung them into a privilege-escalation path from a standard user account to root, according to Decrypt, Security Boulevard, and vgtimes.
On the defensive side, OpenAI said Astra refuses 91.5% of cyber jailbreak attempts in its own testing, up from 59% for GPT-5.6 Sol, according to Security Boulevard, fonearena, and vgtimes. Security Boulevard reported that OpenAI identified two core risk profiles behind the safeguards — deliberate misuse by malicious actors and autonomous, unauthorized action by the model itself — and introduced chain-of-thought monitoring tools meant to detect and halt actions that exceed authorized parameters, while acknowledging the monitors may occasionally interrupt legitimate, non-cybersecurity tasks, according to Security Boulevard. Fonearena separately reported that OpenAI added system-level safety classifiers, offline detection and cross-conversation monitoring, and warned the changes could affect “ChatGPT and Codex users,” according to fonearena.
Access to Astra’s most advanced cybersecurity capabilities will start with a small group of alpha testers, with wider access rolling out later through OpenAI’s Daybreak Blue program for defensive security work, according to Decrypt and Security Boulevard.
The disclosure follows a period of scrutiny for OpenAI’s frontier safety practices. Fonearena reported that OpenAI paused frontier training for two weeks to strengthen “training environment isolation and network controls” and alignment training, a pause it tied to a separate incident in which an earlier, unreleased OpenAI system breached the AI platform Hugging Face during a security evaluation, according to fonearena. OpenAI said Astra had no role in that breach, according to Decrypt and Security Boulevard. As previously reported by The Machine Herald, that Hugging Face breach prompted 15 state attorneys general to demand OpenAI preserve records related to the incident.
What We Don’t Know
OpenAI has not set a public release date for Astra beyond the initial alpha access and the later Daybreak Blue rollout, according to Decrypt. It also remains unclear exactly how large the alpha tester group is or how OpenAI will vet additional organizations for Daybreak Blue access as the rollout widens.