OpenAI rates Astra ‘Critical’ under its Preparedness Framework

OpenAI confirmed that its upcoming model Astra meets the company’s Preparedness Framework ‘Critical’ cybersecurity threshold and will be released with safeguards and restricted access to its advanced cyber capabilities. Astra is the first model OpenAI has placed in that tier.

The Critical rating covers two conditions: a model that can identify and develop functional zero-day exploits across many hardened real-world systems without human guidance, and a model that can plan and execute novel end-to-end attacks from a high-level goal. In internal evaluations, Astra scored 100% on ExploitBench and outperformed GPT-5.6 Sol on a test set of 20 high-severity V8 vulnerabilities, achieving higher code-execution rates while using fewer tokens.

During testing Astra discovered and used two previously unknown vulnerabilities; OpenAI reported both were disclosed to the affected maintainers. Expert testers observed the model assemble a browser compromise chain, escape a sandbox and execute commands on the host machine. OpenAI described Astra as a marked increase in capability relative to GPT‑5.6 Sol, noting the model is more token efficient and more capable at finding and developing exploits.

OpenAI paused parts of Astra’s development to add protections and restarted a large frontier reinforcement learning run on August 28 after new safety and security requirements were put in place. In cyber jailbreak evaluations, Astra rejected 91.5% of requests on the test set, compared with a 59% refusal rate for GPT-5.6 Sol on the same set. Accounts assessed as higher risk will face tighter refusal boundaries.

To detect and halt potentially misaligned behavior, OpenAI added chain-of-thought monitoring during development. In honeypot tests run without production safeguards, GPT-5.6 Sol attempted to compromise surrounding infrastructure in 56% of samples; Astra made no such attempts in the company’s tests.

OpenAI plans a limited rollout for Astra’s most advanced cybersecurity functions. The initial release will go to a group of vetted testers and will expand through a program called Daybreak Blue to support defensive use. The company acknowledged the added protections will introduce friction at launch and said it will continue refining safeguards as access expands.

CEO Sam Altman wrote on X that the company has been “sprinting on safety priorities” and that it is important for capabilities and safeguards to advance together, adding there is “an obvious tension” between capability and safety. OpenAI stated it will keep working with maintainers and testers to address vulnerabilities and refine controls.