.png){kind=logo}
OpenAI’s upcoming AI model, Astra, is set for a wider rollout soon, but its strongest cybersecurity capabilities will not be available to everyone. The company has placed Astra in the Critical cybersecurity tier, the highest operational tier under its Preparedness Framework, after the model scored 100 percent on ExploitBench and demonstrated the ability to identify previously unknown security flaws and develop working exploit chains.
OpenAI says Astra can find zero-day vulnerabilities and build working exploit chains across protected systems with limited human guidance. In a private evaluation involving 20 high-severity V8 flaws, Astra achieved a higher rate of arbitrary code execution than GPT-5.6 Sol while using fewer output tokens.
Astra also found two fresh vulnerabilities during the evaluation and combined them into an exploit chain. In expert-led tests, it compromised a hardened browser, escaped its sandbox, and ran commands on the host. In a separate operating-system assessment, it combined vulnerabilities to gain root access from an ordinary user account.
The model refused 91.5 percent of malicious cybersecurity prompts in OpenAI’s jailbreak testing, compared with 59 percent for GPT-5.6 Sol.
OpenAI says Astra’s capabilities create a dual-use risk. Attackers can also use the same technology that can help defenders discover vulnerabilities and develop patches.
Also Read: Sam Altman Says AI is ‘Scary’ as OpenAI Slows Models Over Safety Concerns
The company has therefore introduced a three-layer safety system. Training teaches Astra to reject prohibited cyber requests and to adhere to authorized boundaries.
System classifiers examine requests and activity across conversations, while a separate monitor tracks the model’s reasoning and tool use. It can stop a run or require human review if it detects potentially unauthorized activity.
For ChatGPT and Codex users, this could mean a job being paused for review. API tasks may end if the monitor intervenes. OpenAI also acknowledges that legitimate work could trigger these controls.
OpenAI began applying its strictest development controls after reaching a preliminary cybersecurity finding on August 7. Parts of Astra’s training and release were slowed while the company strengthened isolation, network access, encryption, weight protection and monitoring.
Astra was not involved in the separate Hugging Face incident, in which other internal models executed code on 41 production servers and gained root access on at least one machine. OpenAI says lessons from that incident were incorporated into Astra’s safeguards.
OpenAI paused deployment-bound reinforcement learning for two weeks and restarted its largest paused run on August 28 after installing stricter controls. Monitoring Astra consumes about 20 percent of the inference compute it monitors.
Astra will initially be available to selected testers, with broader access to advanced cybersecurity expected through Daybreak Blue. OpenAI plans to publish further safety and security details in Astra’s system card at launch.
