OpenAI Says GPT-6 Astra Crosses Its 'Critical' Cyber Threshold

OpenAI said its new flagship model, GPT-6 Astra, is the first it has ever rated "Critical" for cybersecurity risk under its internal Preparedness Framework, a designation the company disclosed alongside the model's Sept. 3 release and that requires extra safeguards before and after launch.

Access started with a small group of customers and is expanding to every ChatGPT Plus, Pro, Business and Enterprise account, plus the OpenAI API and Amazon Bedrock, according to CSO Online. Workspace administrators have to switch Astra on themselves, since it ships turned off.

Developers can call the model as gpt-6-astra at $10 per million input tokens and $50 per million output tokens, with Zero Data Retention available to eligible API customers. The launch follows OpenAI's Sept. 10 move to rent out its Codex harness as a managed API.

What crossing 'Critical' means

OpenAI's own definition sets a high bar: a model meets the threshold if it "can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention," or if it "can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal," OpenAI said in a separate post.

On ExploitBench, OpenAI's internal test of exploit development from known flaws, Astra achieved a perfect 100% score; the prior model, GPT-5.6 Sol, had managed 78.5%. On Terminal-Bench 4.0, a separate test of terminal-based agent tasks, OpenAI put Astra at 57.9%, ahead of Sol's 37.3% and Anthropic's Claude Fable 5.1 at 55.8%, each at a lower estimated API cost per task. A wider exploit-development test called ExploitGym showed a similar gap: 42.4% for Astra versus 30.3% for Sol, with Astra also spending fewer output tokens per attempt.

To rule out the model simply recalling exploits memorized during training, OpenAI ran Astra against flaws that had only become public in the months immediately before launch. The model still surfaced two zero-day bugs nobody had catalogued, which OpenAI is now reporting to the affected software makers.

A disclosure about testing, not about the model itself

On OpenAI's internal cyber jailbreak evaluations, Astra turned down 91.5% of disallowed requests; Sol had refused only 59% of the same set. The version anyone can access will decline to write things like proof-of-concept exploits. OpenAI said it intends to open that capability to a screened group of defenders under a separate program it calls Daybreak.

Sanchit Vir Gogia, chief analyst at Greyhound Research, told CSO Online the Critical label is "a disclosure event rather than a capability event." "Astra's capability did not change between 10 August, when OpenAI said Critical capability could not be ruled out, and September 1, when it said the threshold was met," Gogia said. "The testing changed. The model did not."

Gogia said that inverts the usual response to a risk warning: "Astra is now the only frontier model whose cyber capability an enterprise actually knows, because it is the only one measured against a published threshold, while every unlabelled model already sitting behind enterprise credentials has never been measured that way."

Evaluation	GPT-6 Astra	GPT-5.6 Sol
ExploitBench	100%	78.5%
ExploitGym	42.4%	30.3%
Cyber jailbreak refusal	91.5%	59%

Amit Kumar Jena, head of AI development at Kanerika, told CSO Online that "when an agent acts through a user interface, systems of record log the action as a person, so an agent that updates 400 ERP rows shows up as a service account making 400 updates, with no record of which instruction or model version produced them."