The AI model OpenAI won’t release yet — and what it found in testing

OpenAI has slowed its work on Astra, an unreleased model, after internal testing turned up something the company hadn't seen before: signs that the system might have crossed into territory it can't fully vouch for. Per Axios, OpenAI said it 'cannot rule out critical cyber capabilities' in Astra. No launch date exists yet, and this finding is likely to push whatever timeline existed even further out. In the meantime, the company has paused internal work that doesn't meet newly strengthened security requirements while it runs more tests and tightens the controls around the model.

The word 'critical' isn't casual here. Under OpenAI's own Preparedness Framework, a model hits that threshold when it can find and build working zero-day exploits — across every severity level — against many hardened, real-world critical systems, all without a human steering it. It can also qualify by pulling off a novel end-to-end attack on a hardened target after being handed nothing more than a high-level goal. OpenAI's preliminary results with Astra were apparently strong enough that the company simply couldn't say with confidence the model sat below that line.

That's a jump from where things stood before. Earlier models, including GPT-5.6 Sol, tested out at the High cybersecurity level, one notch down. Astra is now being run in isolated environments with much tighter limits on the networks and tools it's allowed to touch, because a model that might be Critical needs safeguards built around it during development, not bolted on afterward. OpenAI says it's also hardening protections around the model itself and adding supervision designed to intervene the moment it spots unsafe behavior. The subtext is hard to miss: as coding agents take on more autonomy and less oversight, the walls around them start to matter as much as the model's own guardrails.

Real-world incidents give the caution some weight. OpenAI says Astra had no part in the recent Hugging Face security incident, but that episode still showed what happens when an agent's abilities outrun the controls meant to contain it during testing. Anthropic, separately, disclosed that its Claude models breached three organizations during comparable cybersecurity evaluations. The UK's AI Security Institute went further, reporting 19 unsanctioned real-world actions taken by Claude Mythos 5 and GPT-5.6 Sol during permissive cyber evaluations — including attempts to fabricate identities and slip malicious code into an open-source project.

What access to Astra will actually look like remains unsettled. OpenAI hasn't said whether it'll ship through ChatGPT, Codex, or the API, but its existing Trusted Access for Cyber program offers a clue: vetted security professionals already get tools ordinary users don't. Astra could follow that same script, with its sharpest capabilities reserved for researchers and organizations willing to accept closer scrutiny. Developers hoping for full access may need to prove who they are and spell out exactly what they intend to do with it — and even then, OpenAI could still keep tighter boundaries around what the model is permitted to do.