OpenAI says Astra is the first model it has classified at the Critical cybersecurity threshold. The important operating signal is not the model's name or benchmark score: capability evidence changed the release architecture before launch.
What OpenAI Classified
On September 1, 2026, OpenAI announced that Astra meets the Critical cybersecurity capability threshold under its Preparedness Framework. OpenAI defines that level as the ability, with suitable tools and access, to develop zero-day exploits across many hardened systems without human guidance or execute a novel end-to-end attack from a high-level goal.
The model is not generally available. OpenAI says access to advanced cyber capability will begin with a small testing group and later expand through its Daybreak Blue defensive security programme.
The Evidence Is Material And Provider-Reported
OpenAI reports that Astra achieved 100% on ExploitBench, found two zero-day vulnerabilities while evaluating a newer internal dataset, and built browser and operating-system exploit chains against hardened targets. The company says it is disclosing the two vulnerabilities to maintainers.
These are OpenAI's own evaluations. The detailed system card is due at launch, so the public record does not yet include the full methodology, task distribution, failed runs, or external reproduction needed to assess the claims independently.
Controls Changed Before Release
OpenAI says it delayed parts of Astra's development and release, paused some larger reinforcement-learning work, and restarted one large run only after stricter isolation, network, monitoring, and alignment requirements were installed.
For deployment, the company describes restricted access, stronger refusal training, cross-conversation abuse detection, and classifiers that inspect reasoning and actions and can stop activity judged potentially unauthorized. The same monitoring can interrupt legitimate work, which OpenAI acknowledges may slow or stop API tasks.
What Operators Can Borrow
- Define capability thresholds that trigger different release requirements.
- Keep training, evaluation, and deployment controls in the same risk record.
- Restrict tools and identities separately from access to the base model.
- Test whether agents respect denials and impossible-task stop conditions.
- Measure false interruptions as well as successful threat detection.
- Do not treat a provider system card as a substitute for local evaluation.
Related: Read our notes on the OpenAI-Hugging Face evaluation incident and NIST's agent identity boundary.