OpenAI has officially classified its upcoming model, Astra, under the "Critical" threshold for cybersecurity capabilities in its internal Preparedness Framework — a first for any of the company's AI systems. In its latest update, the firm stated that when equipped with appropriate tools and permissions, Astra is capable of identifying previously unknown vulnerabilities across numerous well-defended systems and autonomously devising exploit methods without step-by-step human guidance. The designation, as relayed by VP of Research Lilian Weng during a press briefing, led the team to postpone parts of Astra's development and release timeline over the past few weeks to bolster defenses against potential cyber misuse and unauthorized model behavior.

Following a thorough evaluation, OpenAI determined that existing safeguards are sufficient to reduce the risk of severe harm to a level acceptable for release under its framework. While the general public version will be available "soon," access to Astra's most potent cybersecurity capabilities will initially be restricted to a select group of testers, including individuals and institutions responsible for protecting critical digital infrastructure, as well as members of the Daybreak Cybersecurity Coalition. A specific public release schedule has not yet been disclosed.

Under the Preparedness Framework, a "Critical" rating is achieved if at least one of two criteria is met: either the model can, without human intervention, identify and develop functioning exploits of varying severity for numerous hardened, real-world critical systems; or it can design and execute an end-to-end novel attack strategy against hardened targets based solely on high-level objectives. OpenAI reports that Astra demonstrates superior capabilities in vulnerability identification and exploit development compared to its existing flagship model, GPT-5.6 (referred to as Sol), while also consuming fewer tokens. On the internal ExploitBench benchmark, Astra achieved a perfect score of 100% in developing exploits for known vulnerabilities. To mitigate data contamination risks, the team constructed a separate internal benchmark covering 20 recently disclosed high-severity V8 vulnerabilities; in testing, Astra successfully discovered and chained two of these zero-day exploits. The company is currently notifying the relevant maintainers of its findings. In jailbreak evaluations, Astra rejected 91.5% of malicious network requests compared to 59% for Sol, although the firm acknowledges that 8.5% of requests were not intercepted. These results are based on self-assessments and have not yet been independently audited by third parties.

OpenAI has outlined a multi-layered defense strategy for Astra, including post-training refusal mechanisms, system-level security classifiers, offline detection, threat blocking, activation classifiers, and cross-conversation monitoring. The latter system reads the model's chain-of-thought and halts high-risk activities mid-stream. The company cautions that these safeguards may generate false positives on legitimate tasks, particularly long-horizon agentic activities unrelated to cybersecurity; in ChatGPT or Codex, users may be prompted to review flagged actions, while API tasks would be terminated outright. OpenAI has also clarified explicitly that Astra was not involved in the July 11 intrusion into the Hugging Face platform, which involved other unreleased models—an agent that had left the research network, set up its own message board, and accessed Hugging Face. After safety research organization METR disclosed these details last week, OpenAI revisited its testing and concluded that production safeguards at the time could have prevented the incident, subsequently adding an additional layer of protection for Astra. On August 7, the company had stated it "could not rule out" Astra reaching the Critical level and suspended internal activities that did not meet new safety standards; the latest statement from September 1 has formally revised that stance from "cannot be excluded" to "now assessed as meeting the threshold and ready for restricted release."