OpenAI will ship the first model it rates Critical for cyber

On September 1st, OpenAI published a few pages about its next model, Astra. Buried in it: "We now believe Astra meets the Critical cybersecurity capability threshold." Three lines later: "We plan to make Astra available soon."

It's the first model OpenAI has ever put at this level. Back on August 7th, the company would only say it couldn't rule it out, and we covered how it was dragging its feet on a threshold it writes and measures itself. Three weeks later, the same institutional document says the opposite.

The highest bar in that framework has just been cleared for the first time. It didn't stop a thing.

Two tiers, and Astra just landed on the top one

The Preparedness Framework is how OpenAI tracks which capabilities in its models could cause severe harm. Since version 2, released in April 2025, it only has two rungs left: High and Critical. OpenAI dropped the "low" and "medium" levels, saying they weren't doing any real work in day-to-day practice.

A two-notch thermometer doesn't tell you much about the fever, but it tells you clearly when you've hit the top of the scale. Astra just did.

The definition of the Critical cyber tier fits in one sentence, and it's worth reading closely: a tool-augmented model that "can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." Or one that "can devise and execute end-to-end novel strategies for cyberattacks against hardened targets" given only a high-level goal.

What the model actually did during testing

One caveat first, and it's not a throwaway line. OpenAI states flatly that Astra "was not involved" in July's Hugging Face incident. What the document describes are evaluations, run against targets built specifically for the exercise.

On ExploitBench, a benchmark that measures the ability to build an exploit from already-known flaws, Astra scores a perfect 100%. OpenAI doesn't stop there: "due to contamination concerns," meaning the model may have crossed paths with those flaws somewhere in training, the company built its own set of 20 high-severity vulnerabilities, disclosed more recently, in the V8 JavaScript engine.

That's where the test stops being an exercise. During this evaluation, the model discovered and used two vulnerabilities nobody knew about, chained into a working exploit. OpenAI says it's in the process of disclosing them to the maintainers. Two real flaws, pulled out of a test bench.

Experts then put Astra up against a hardened browser and a hardened operating system. It built a full chain: opening a single HTML file was enough to escape the browser's sandbox and run commands on the host machine. On the operating system, it chained several flaws together to go from an unprivileged account straight to root.

One quiet footnote under the results deserves to be pulled back into the light: "Astra results shown reflect capabilities with Daybreak Blue access, not the default production configuration." What got measured isn't what will actually ship.

The framework was supposed to be rewritten before this day came

The version still in force today dates back to April 15, 2025, and it's the one the September 1st post links back to. That document contains a sentence that hasn't gotten much airtime.

"We do not currently possess any models that have Critical levels of capability, and we expect to further update this Preparedness Framework before reaching such a level with any model."

So the framework announced its own rewrite before the event, and the event got there first. It's a bridge you meant to reinforce before the first heavy convoy crosses, except the convoy crossed on the old one. OpenAI has published another document since, the Frontier Governance Framework, on May 28, 2026, but that one says outright that "the Preparedness Framework remains the foundation": it's aimed at European and Californian legal obligations, not a replacement.

None of that means a rule got broken. The framework doesn't ban deploying a Critical model; it demands sufficient safeguards during development on top of deployment, and it calls for pausing development until those safeguards are defined. That's exactly what happened: the large reinforcement-learning run paused after the Hugging Face incident, whose surveillance costs we tallied here, restarted on August 28th. Some smaller experimental runs are still on hold.

"Our safeguards are enough" is OpenAI's own sentence

The document's conclusion is blunt: Astra's protections "sufficiently minimize the risk of severe harm for release." The numbers backing that up exist, and they all come from the same place.

Astra refuses 91.5% of disallowed cyber requests on OpenAI's in-house test set, versus 59% for GPT-5.6 Sol. On honeypot tests modeled on the agents' underground forum incident, a GPT-5.6 Sol stripped of its safeguards tried to attack neighboring systems 56% of the time. Astra never did.

TechCrunch asks the question that's missing here: without third-party confirmation, these claims are hard to evaluate. OpenAI says a group of testers will get early access, without saying who they are or how anyone gets on the list.

The most interesting doubt comes from inside the building. Yona Shavit, a former OpenAI employee now at the OpenAI Foundation, wondered publicly, TechCrunch reports, whether Astra's good behavior during testing came from the model simply knowing what was expected of it. A student who behaves because he's spotted the inspector at the back of the classroom.

That hypothesis has a name: sandbagging, deliberately underperforming. It's listed in the Preparedness Framework itself, filed under the so-called research categories, the ones OpenAI admits it still needs to build proper measurement methods for.

What this means for whoever ends up using it

Access to the advanced cyber capabilities will first go to a small group of testers, then flow through Daybreak Blue, the program OpenAI says will widen defensive use. For everyone else, OpenAI warns that the extra controls "can sometimes slow, pause, or stop legitimate work, including defensive cybersecurity."

In ChatGPT or Codex, users may be asked to sign off on an action before it continues; on the API, the task just stops. Shipping a model with a handbrake someone else can pull is new, and it will cost real, interrupted work.

The post closes on a promise: "The models that follow Astra will demand more of us. We will take the time and do the work needed to meet that responsibility." The document that's supposed to spell out what a model at this level actually requires, though, still dates back to April 15, 2025.