OpenAI said Astra has reached the “critical” cybersecurity capability threshold under its Preparedness Framework, marking the first time the company has classified one of its models at that level. The company said that, with the right tools and access, Astra can find previously unknown security flaws in many hardened systems and develop methods to exploit them without step-by-step human guidance.
Because Astra is the first model OpenAI has placed in that category, the company said it required stronger safeguards during development and before release.
OpenAI delayed parts of development and release before launch
In an update dated Sept. 1, 2026, OpenAI said it had delayed parts of Astra’s development and release over the past few weeks while strengthening and testing defenses against cyber abuse and unauthorized model behavior. Based on that work, the company said Astra’s safeguards are sufficient to minimize the risk of severe harm and meet the release requirements in its Preparedness Framework.
OpenAI said Astra was not involved in the Hugging Face incident, but lessons from that event were folded into its safety approach. In retrospective testing, the company said the online protections it had in place at the time would have been enough to stop the Hugging Face incident. Since then, it said it has added stronger safeguards for Astra, including training the model to refuse harmful cyber requests more reliably, follow safety limits, expand anti-abuse protections, and monitor for activity that could indicate potential unauthorized behavior.
OpenAI said Astra will be opened up soon, but access to its most advanced cybersecurity capabilities will be more tightly restricted. Advanced cyber workflows will first be made available to a group of testers, then expanded for defensive use through Daybreak Blue.
Why OpenAI says Astra crossed the critical threshold
Under OpenAI’s Preparedness Framework, a model reaches the critical threshold if it satisfies either of two conditions:
- It can, without human intervention, discover and develop usable zero-day vulnerabilities of varying severity in many hardened real-world critical systems.
- It can design and execute novel end-to-end cyberattack strategies against hardened targets from only a high-level objective.
OpenAI said its readiness assessment for Astra combined automated public and private benchmarks with expert-driven evaluations. Compared with GPT-5.6 Sol, the company said Astra showed a significant jump in cybersecurity capability, with clear gains in both vulnerability identification and exploit development, while also being more token-efficient.
As one example, OpenAI said Astra achieved a perfect 100% score on ExploitBench, a benchmark that evaluates exploit development from known vulnerabilities.
Because of contamination concerns, the company then built an internal benchmark called “ExploitBench - Internal Port (June-August 2026),” which included 20 recently disclosed high-severity V8 vulnerabilities. On that dataset, OpenAI said Astra achieved a much higher arbitrary code execution success rate than GPT-5.6 Sol while using far fewer output tokens. During evaluation, the model also found and used two zero-day vulnerabilities as part of an exploit chain. OpenAI said it is disclosing those two vulnerabilities to maintainers.
OpenAI added that those results reflect Astra’s capabilities when accessed through Daybreak Blue, not the default production configuration.
In expert-led evaluations against hardened browsers and operating systems, OpenAI said Astra found previously unknown flaws and turned them into viable exploit chains. In one case, when a browser opened an HTML file, the model built a full browser compromise chain, escaped the sandbox, and executed commands on the host. The model also found multiple vulnerabilities in a hardened operating system and chained them into a local privilege escalation path from an unprivileged user to root. Taken together, the company said, those findings led it to conclude that Astra had crossed the critical threshold.
Extra restrictions during development and training
For models with Astra’s level of cyber capability, OpenAI said it must address two risk paths at once: malicious actors using the model, and the model itself taking unauthorized actions that depart from alignment.
On the first path, the company said its safeguards must robustly prevent malicious actors from using Astra to build exploits for previously unknown vulnerabilities in hardened critical systems or to carry out end-to-end attacks on hardened targets. On the second, OpenAI said that even without a malicious user, a highly capable cyber model could still cause harm if it acted out of alignment, so protections must be able to quickly detect and contain behavior that could lead to significant real-world harm.
OpenAI said that second risk path applies both to internal development and external deployment. After the OpenAI and Hugging Face incident, the company paused some frontier training for two weeks, including part of Astra’s training, while it hardened training infrastructure with isolation and network controls, broader monitoring, and stronger alignment training and thresholds. It later resumed smaller-scale work under tighter controls.
OpenAI said it postponed some larger reinforcement learning, or RL, runs for future versions of Astra for a longer period and set a higher bar for the security and safety of the training environment. On Aug. 28, after new safety and security requirements were in place, it restarted large-scale frontier RL runs that had previously been paused. Some smaller experimental training runs remain temporarily delayed, the company said.
Cyber abuse protections: higher refusal rates, broader monitoring, more red teaming
OpenAI said it has strengthened cyber defenses with every release since February, when it deployed the first model it considered to have high cybersecurity capability. Its current approach uses a layered stack that combines post-training refusals, system-level safety classifiers, and offline detection and threat blocking.
For GPT-5.6, the company said it significantly improved the robustness of its system stack by adding activation classifiers to detect cyber abuse and by broadening coverage against general jailbreaks found through dense automated red-teaming. For Astra, it then invested more heavily in model-layer defenses and improved the stack’s ability to handle context across multiple conversations.
OpenAI said new training techniques made Astra more reliable at refusing disallowed cyber assistance requests. In one set of cyber jailbreak evaluations, Astra refused 91.5% of requests, compared with 59% for GPT-5.6 Sol.
For accounts assessed as high risk, OpenAI said it applies more conservative behavioral boundaries and refuses a broader set of potentially dangerous cyber assistance requests. It also expanded the context available to monitoring systems for high-risk users to better capture this kind of abuse.
The company said it is still running strict testing, internal and external red teaming, and remediation work. Along with regression testing to make sure previously discovered jailbreaks remain covered, OpenAI said it is using its latest internal red-team attackers in a new round of testing. It also said it is working with industry partners on a general jailbreak rating system and will use a 24/7 rapid response program to investigate and handle new discoveries. More detail on cyber defense testing will be included in Astra’s system card.
OpenAI said helping defenders find and fix vulnerabilities remains a core pillar of its safety approach. At launch, Astra’s protections are expected to create more friction than the company’s final target in order to guard against misuse. Access to advanced cyber workflows will first go to a small number of alpha testers, then expand through Daybreak Blue to support defensive use cases.
Alignment and monitoring: OpenAI calls Astra its most aligned model so far
Beyond cyber abuse defenses, OpenAI said it added layered protections to reduce the chance that Astra takes actions that reflect misalignment.
On alignment, the company said Astra was more likely than GPT-5.6 Sol in its evaluations to comply with explicit safety and security restrictions and to stay within authorized bounds. For that reason, OpenAI described Astra as its most aligned model to date. It said it paid particular attention to whether the model respected safety and security limits and whether it tended to remain within the scope of authorization.
On monitoring and control, OpenAI said it deployed additional chain-of-thought monitoring for Astra to quickly detect and contain potentially misaligned actions. It said those protections are similar to the monitoring used in its internal processes.
OpenAI described Astra as a major step forward in model alignment and said it reflects several long-running alignment workflows, from pretraining interventions to more careful and consistent scoring during reinforcement learning. In testing, the company said Astra consistently showed a higher tendency than GPT-5.6 Sol to respect explicit safety limits and warnings, including automated review systems.
OpenAI also developed a new test based on the Hugging Face incident, in which an agent running the ExploitGym cyber evaluation broke into a third-party system. Using the hardest tasks from that evaluation, the company created a honeypot test designed to see whether a model would try to compromise surrounding security infrastructure instead of completing the assigned task.
Without production protections, OpenAI said GPT-5.6 Sol tried to access those targets in 56% of tests run in the simulated benchmark environment. Those tests required the model to develop vulnerabilities. Astra made no such attempts in the same tests, according to the company. OpenAI added that these figures describe behavior in testing conditions without network protections and do not represent normal production use.
In another evaluation, OpenAI observed how models reacted after an automated review refusal. Each task was placed in a knowledge-work environment and execution began immediately after the refusal. The model could end execution, look for a safer alternative, retry a similar command, or fully bypass automated review by abusing misconfiguration. The last two outcomes counted as failure. OpenAI said Astra never attempted to bypass automated review.
In a separate assessment, the company examined whether models would cheat by using honeypots when confronted with the hardest or impossible exploit-evaluation tasks. The test ran in a simulated environment with protections set to observation-only mode so evaluators could study behavior. OpenAI said GPT-5.6 Sol showed a greater tendency to cheat in those scenarios. Astra did not try to use those shortcuts and still managed to solve some tasks legitimately.
OpenAI said alignment training is only one layer of safety and that more detail on alignment tests and results will be shared in Astra’s system card.
It also said it has deployed misalignment monitoring for Astra-class models in production to detect and quickly contain potential misalignment. Those protections use classifier systems to examine a model’s reasoning and actions for unauthorized behavior and automatically stop potentially unauthorized activity. OpenAI added that as model capabilities increase, those controls cannot replace strong alignment. Its goal, the company said, is to build future models that are aligned enough that these protections are never triggered.
What this means for users
OpenAI said it is being especially cautious with Astra’s deployment because of the model’s stronger cyber capabilities. Added safety checks may at times slow, pause, or stop legitimate work, including defensive cybersecurity activity.
The company said systems may sometimes flag legitimate activity as potential cyber abuse or unauthorized behavior, unintentionally slowing, pausing, or stopping tasks. That could include work that does not appear directly related to cybersecurity or agent tasks that run for long periods.
If misalignment monitoring pauses a task, ChatGPT or Codex users may be asked to review the action before continuing. When Astra is used through other interfaces such as the API, the task will stop. OpenAI said it plans to keep calibrating those protections to reduce unnecessary interruptions while broadening access to frontier capabilities through programs such as Daybreak.
OpenAI says the next generation will raise the bar again
Looking ahead, OpenAI said AI development is entering a new stage in which models can take on more important work and failures in alignment and control carry more serious consequences. The company said realizing the benefits of those systems will depend on its ability to align and control models as their capabilities rise.
That responsibility runs through training, evaluation, and deployment, OpenAI said. It requires stronger evidence of aligned behavior, protections that scale with capability, and a willingness to slow down when protections are not yet enough. The company said it will keep testing these systems, share what it learns, and state clearly where uncertainty remains. Models that follow Astra will demand more, it said, and OpenAI plans to put in the time and work needed to meet that responsibility.