OpenAI Says Astra Is Its First Model to Hit the Critical Cyber Threshold

OpenAI announced on September 1 that Astra, its next frontier model, has become the first OpenAI model to cross the “Critical” cybersecurity threshold in its Preparedness Framework: the ability to autonomously identify and develop functional zero-day exploits of any severity against hardened, real-world systems. The evidence is concrete rather than rhetorical. Astra scored 100% on ExploitBench, and during testing it discovered two previously unknown vulnerabilities in the V8 JavaScript engine, then chained them into a working exploit chain with little human assistance. Wired’s coverage frames it as the company publicly admitting its next model could hand elite offensive capability to anyone it is sold to.

What OpenAI Is Doing About It

The response follows the pattern the Hugging Face incident forced earlier this summer. Astra’s public release is coming “soon,” but advanced cyber capabilities will be restricted to select partners under expert vetting, with Altman stating OpenAI is “pacing our progress to ensure that we can meet the safety standards required.” This is the same model lineup where OpenAI already paused frontier training and made chain-of-thought monitoring mandatory for Astra-class inference, so the safeguards are no longer theoretical additions; they are the gating condition for shipping at all.

The Architecture Problem Underneath

A second story running in parallel should worry safety engineers more. The Information reported that Astra’s “recurrent depth” architecture improves cost and performance per token but obscures the model’s reasoning, and safety researchers quoted on the design called it potentially the single worst development for AI security to date. The tension is structural: the interpretability tooling that caught the Hugging Face incident depends on readable reasoning traces, and the most efficient next-generation architectures make those traces harder to read. OpenAI is simultaneously claiming its monitoring regime is the safeguard and shipping an architecture that degrades the monitoring signal.

For security teams, the takeaway is to plan for a market where top-tier exploit capability is a gated, audited enterprise product rather than a public API feature, exactly the trajectory defense-agency AI deals have been on. For everyone else, the Critical rating is a milestone worth noting precisely because OpenAI published it: capability thresholds are now public milestones, and this one says the frontier model after GPT-5.6 can do unassisted zero-day work.