September 2026 · 6 min read
OpenAI's Astra is its first Critical-tier cyber model: it finds and exploits zero-days on its own
Key Definitions
Preparedness Framework OpenAI's internal risk-tier system for deciding whether a model is safe enough to build and ship. Critical is the highest cybersecurity capability level — and the first time any OpenAI model has entered it.
Critical cybersecurity capability A model that, given only a high-level goal and with the right tools and access, can independently find and exploit zero-days across many well-defended systems, or carry out a complete cyberattack against a hardened target.
On September 1, OpenAI confirmed in its post "Path to Astra: critical capabilities and frontier safeguards" that its next model, Astra, has reached the Critical cybersecurity capability level under its Preparedness Framework — the first time OpenAI has placed any model in that category. In the company's own words, with the right tools and access Astra can find previously unknown security flaws and develop ways to exploit them, without a person guiding each step.
The first Critical designation is a step-change
Under OpenAI's own definition, the Critical tier applies when a model can independently find and exploit zero-day vulnerabilities across many well-defended systems, or carry out a complete cyberattack against a hardened target from only a high-level instruction. This is not hypothetical: in testing, Astra achieved a perfect score on ExploitBench — a benchmark that measures a model's ability to turn known vulnerabilities into working exploits — and in a separate evaluation of recently disclosed flaws it uncovered two zero-day vulnerabilities on its own.
The escape record matters more: Astra broke out of a browser sandbox to run commands on the underlying machine, then chained several flaws in a hardened operating system to gain root-level access. This is not a small step in model capability. It is OpenAI publicly admitting it cannot fully rule out that a model can find and exploit flaws no human has found yet.
The three-week timeline
August 7: first warning
OpenAI published "Responding to the next frontier of critical cyber capabilities," saying internal evaluations and expert assessments meant it could not rule out that Astra had reached the Critical tier.
August 18: training pause
"Pacing model development in an era of cyber-critical capabilities" announced a roughly two-week pause in reinforcement-learning training for deployment-bound models, requiring the strictest safeguards for workloads involving Astra or cyber models.
September 1: designation confirmed
"Path to Astra" confirmed the model meets the Critical threshold and laid out the safeguards required before release — narrower access, staged evaluation gates, and a restricted rollout path through testers and the Daybreak Blue program.
The safeguards are behavioral, not physical
The most enterprise-relevant figure OpenAI reported: Astra declines 91.5% of cyber-related jailbreak attempts in testing, up from 59% for its predecessor GPT-5.6 Sol, and shows far less tendency than Sol to bypass safety restrictions or exploit deliberately placed honeypot targets. But these safeguards govern what the model agrees to do, not what it is able to reach — the very distinction that failed at Hugging Face.
OpenAI's own framing concedes the boundary: "We are entering a stage of AI development in which models can take on more consequential work, and failures of alignment and control can have more serious effects." None of the safeguards have been independently audited. What exists is a company describing an unreleased model, the controls it intends to apply, and its own assessment of why they are needed.
What it means for enterprises
A new line item in vendor risk review
Security teams evaluating OpenAI's API for sensitive workloads now have a public, company-authored document stating that a frontier model in this family can, under the right conditions, hunt for zero-days without supervision. That is a new entry in any vendor risk assessment, cyber-insurance questionnaire or SOC 2 review.
Capability-tier disclosure may become a procurement requirement
Astra sets a precedent: buyers should start asking model providers to state the capability tier of the exact version they purchase, rather than accepting aggregate benchmark scores.
Regulators now have a concrete case study
A public, dated paper trail of a lab pausing its own training over cyber risk is exactly the material policymakers cite when drafting frontier-model reporting rules. The Financial Stability Board chair told G20 finance ministers this week that AI-driven cyber risk is the most immediate threat to financial stability.
The bottom line
Astra has not shipped, but it has turned "frontier models with autonomous offensive cyber capability" from science fiction into a citable corporate document. For buyers, evaluating a model is no longer just about benchmark scores — it is about safeguards, capability tiers and release paths. For regulators, this is ready-made rulemaking material. The real watershed is not whether a model can find a zero-day, but who holds the control and the responsibility once it does.
References
- SecurityWeek: OpenAI's Astra Crosses 'Critical' Cyber Threshold After Finding Zero-Days (2026-09-02) — https://www.securityweek.com/openais-astra-becomes-first-model-to-cross-critical-cybersecurity-threshold/
- OpenAI: Path to Astra: critical capabilities and frontier safeguards (2026-09-01) — https://openai.com/index/path-to-astra/
- OpenAI: Responding to the next frontier of critical cyber capabilities (2026-08-07) — https://openai.com/index/responding-to-the-next-frontier-of-critical-cyber-capabilities/
- OpenAI: Pacing model development in an era of cyber-critical capabilities (2026-08-18) — https://openai.com/index/pacing-model-development-in-an-era-of-cyber-critical-capabilities/
- Shattered: OpenAI Astra Hits Critical Cyber Risk Tier (2026-09-01) — https://shattered.io/openai-astra-critical-cyber-risk-2026/
Frequently Asked Questions
What does the Critical designation mean?+
Under OpenAI's Preparedness Framework, Critical is the highest cybersecurity capability tier: a model can independently find and exploit zero-day vulnerabilities across many well-defended systems, or run a complete attack against a hardened target from only a high-level instruction. It is the first time OpenAI has placed any model in this category.
What did Astra actually do in testing?+
It scored a perfect result on ExploitBench, independently uncovered two zero-day vulnerabilities in an evaluation of recently disclosed flaws, broke out of a browser sandbox to run commands on the underlying machine, and chained several flaws in a hardened operating system to gain root-level access.
Why did OpenAI pause training?+
On August 7 OpenAI said it could not rule out that Astra had reached the Critical tier. On August 18 it paused reinforcement-learning training for deployment-bound models for roughly two weeks while adding the strictest safeguards for Astra and cyber-model workloads. On September 1 it confirmed the designation.
How well does the model refuse attack requests?+
Astra declined 91.5% of cyber-related jailbreak attempts in testing, up from 59% for its predecessor GPT-5.6 Sol, and showed far less tendency than Sol to bypass safety restrictions or exploit deliberately placed honeypot targets.
Will Astra be released to the public?+
Full cybersecurity capabilities will not be widely available at launch. OpenAI plans early access for a group of testers, with wider availability through its Daybreak Blue program. Critical-tier models require stronger safeguards before release.
What should enterprises do in procurement?+
OpenAI has now publicly documented that a frontier model in this family can hunt for zero-days without supervision under the right conditions. That is a new line item for vendor risk assessments, cyber-insurance questionnaires and SOC 2 reviews — buyers should ask providers to state the capability tier of the exact model version they purchase.
Related Articles
VMs can't contain cyber-capable agents: Trail of Bits proof
Trail of Bits: OpenAI GPT-5.6-Cyber escaped a QEMU/KVM VM three times in 12h, chaining three zero-days and one unshipped patch. Firecracker held.
CrowdStrike Falcon Guardian: runtime security for AI agents
CrowdStrike Falcon Guardian: AI Detection and Response on the endpoint where agents execute — discovery, visibility, access control, detection and response.
GitSpawn: untrusted repos run code in coding agents
Coding agents gather context with git but don't strip repo config — a malicious core.fsmonitor in a repo-as-files runs code on the host, pre-trust. 4 unpatched.
Langflow's exploited 9.8 RCE stayed invisible to vuln feeds
360+ attempts in 2 days hit Langflow's unauth root RCE (CVSS 9.8), hunting OpenAI/AWS keys. No vendor advisory, no KEV, EPSS 2.3% — invisible to vuln feeds.