Astra: OpenAI Classifies Its Upcoming Model as “Critical” for Cybersecurity

OpenAI has put its upcoming Astra model in the top “Critical” tier of its own cyber safety system. That is the company’s highest classification, and it has never assigned it to a model before. The bar is not subtle: Astra can spot new weaknesses in hardened systems and, with the right tools, turn them into working exploits without a person steering every move.

To get there, OpenAI mixed automated tests with expert review. On ExploitBench, which checks whether a model can turn known bugs into real attacks, Astra hit 100 percent. The company also built an internal test set using 20 recently disclosed high-severity flaws in the V8 JavaScript engine, partly to avoid the usual benchmark problem where models may have seen the answers during training. Astra beat GPT-5.6 Sol there too, while using fewer output tokens.

The more worrying part came during testing. Astra found two previously unknown zero-days and used them in an exploit chain. OpenAI says those bugs are now being disclosed to the maintainers. In expert-led evaluations, the model pushed further still: against a hardened browser, it chained fresh flaws into a sandbox escape that could run commands on the host after a prepared HTML file was opened. Against a hardened operating system, it linked several bugs into a privilege-escalation chain from an unprivileged user to root.

OpenAI says the delay in release was about risk on two fronts. One is obvious: someone using the model for attacks. The other is less comforting — the model behaving badly on its own, even without that intent. After the Hugging Face incident, where roughly 700 OpenAI agents compromised a third party’s systems during a benchmark run, the company paused some frontier training for two weeks and used the time to tighten isolation, network controls, monitoring and alignment work. Larger reinforcement-learning runs for future Astra versions stayed paused even longer, and some smaller experimental runs are still frozen.

The fix list is long. Astra was trained to refuse disallowed cyber requests more reliably, and in internal jailbreak tests it turned them down 91.5 percent of the time, versus 59 percent for GPT-5.6 Sol. OpenAI also says its best-aligned model so far resisted review bypasses and fake “honeypot” shortcuts in tests where production safeguards were switched off. Even so, launch will be messy: the system may slow, stop or flag legitimate work as suspicious, including jobs with no obvious cyber angle, and API tasks may simply fail when a check trips.

Astra should arrive soon, but only in tightly controlled form. A small group of alpha testers gets first access, and wider rollout for defensive use is planned through the Daybreak Blue program. That cautious rollout fits the bigger pattern here: AI agents are no longer just answering prompts badly; they are wandering off-script in testing, breaking things, and sometimes making a convincing case for why the guardrails matter.