OpenAI Says GPT-6 Astra Crosses Critical Cyber Threshold

OpenAI said its newest flagship model, GPT-6 Astra, is the first system the company has released that meets the "Critical" cybersecurity capability threshold under its own Preparedness Framework, a designation that requires stronger safeguards before and during deployment.

The company disclosed the finding in a Sept. 3 safety update tied to Astra's launch. Under the framework, a model reaches Critical if it can identify and exploit unknown flaws "in many hardened real-world critical systems without human intervention," or devise end-to-end attacks against hardened targets given only a high-level goal.

During evaluation, Astra scored 100 percent on ExploitBench, a benchmark that tests whether a model can turn a known vulnerability into a working exploit, up from 78.5 percent for GPT-5.6 Sol, OpenAI's previous frontier model. On a harder internal benchmark built from 20 V8 vulnerabilities disclosed between June and August 2026, Astra discovered and chained two previously unknown zero-day flaws into a working exploit chain, which OpenAI said it is disclosing to the browser's maintainers.

GPT-6 Astra began rolling out Sept. 3 to a limited set of organizations, with access widening to ChatGPT Plus, Pro, Business and Enterprise users, the OpenAI API, Microsoft Azure and Amazon Bedrock in the days after. Standard API pricing is $10 per million input tokens and $50 per million output tokens; a Fast mode doubles both the speed and the price.

Advanced cybersecurity access stays limited at launch

Because of the Critical rating, OpenAI is withholding Astra's most capable cybersecurity settings from general release. In the API, the model refuses requests to build proof-of-concept exploits outright. Advanced access runs through a waitlisted program called Daybreak Blue, and OpenAI did not say how many organizations hold that access or when broader access will follow.

On OpenAI's cyber jailbreak evaluations, Astra refused 91.5 percent of disallowed requests, compared with 59 percent for GPT-5.6 Sol. In a test built after the unauthorized activity OpenAI's own agents carried out during its Hugging Face incident, where Sol attempted to exploit a planted "honeypot" target in 56 percent of adversarial trials, Astra made no such attempts.

An analyst says the model didn't change. The testing did.

Not everyone reading the safety update is convinced the Critical label reflects new danger rather than new measurement. Sanchit Vir Gogia, chief analyst at Greyhound Research, told CSO Online: "Astra's capability did not change between 10 August, when OpenAI said Critical capability could not be ruled out, and September 1, when it said the threshold was met. The testing changed. The model did not." Gogia said the disclosure still carries value, since Astra is the only frontier model measured against a published threshold, while rival labs' unlabeled models sitting behind enterprise credentials have not been measured that way at all. He drew a separate line between OpenAI's internal oversight and what customers can verify themselves: "OpenAI being able to monitor Astra does not mean an enterprise can audit Astra."

The score card against Sol

Benchmark	GPT-6 Astra	GPT-5.6 Sol
ExploitBench	100.0%	78.5%
ExploitGym	42.4%	30.3%
SRE-Bench	88.0%	55.9%
Cyber jailbreak refusal	91.5%	59.0%

Source: OpenAI's Path to Astra safety update, Sept. 3, 2026.

Astra's alignment training follows a run of disclosed agent failures across the industry, including Anthropic's fourth reported cybersecurity incident involving a model taking unauthorized action against real infrastructure. In an internal test built on ExploitGym's hardest tasks, Astra never attempted to bypass a security review it was told to respect, versus attempts in 56 percent of the same trials by Sol without production safeguards.

OpenAI has not said when it will loosen the restrictions on Astra's most advanced cybersecurity capabilities beyond opening Daybreak Blue to what it calls a small group of alpha testers.