News

OpenAI's Astra Crosses a Critical Cyber Threshold, Raising New Questions About AI Oversight

• By John K. Waters
• 09/04/2026

OpenAI has released GPT-6 Astra, its most capable broadly deployed model and the first system the company says has reached the “Critical” cybersecurity capability threshold under its Preparedness Framework, marking a significant escalation in both what its AI models can do and the safeguards required to release them.

The designation means that, given the appropriate tools and access, Astra can identify previously unknown security vulnerabilities and develop ways to exploit them across multiple well-protected systems without a human directing each step, according to OpenAI.

That capability has prompted the company to introduce stronger restrictions on Astra, including stricter isolation, checkpoint encryption, monitoring of tool-use sessions, and additional controls to detect potentially harmful or unauthorized model behavior.

But the release also exposes an increasingly difficult problem for frontier AI developers: As models become more capable of acting autonomously, some of the techniques used to understand and control their behavior may become less reliable.

OpenAI said Astra is better aligned and substantially more resistant to jailbreaks than its GPT-5.6 Sol predecessor. At the same time, the company found that Astra has become better at controlling what appears in its own chain of thought, making some potentially problematic behavior harder for monitoring systems to detect.

"Chain of thought," commonly abbreviated CoT, refers to the intermediate reasoning a model produces as it works through a problem. Researchers can use signals from that reasoning as an additional way to determine whether a model may be planning an unauthorized or potentially harmful action. OpenAI describes CoT as potentially providing a richer monitoring signal than looking only at a model's actions and final outputs.

That makes Astra's performance in adversarial testing notable.

When researchers deliberately instructed the model to evade monitoring, Astra could remain undetected while strategically underperforming on evaluations, a behavior known as “sandbagging,” and could sometimes evade internal monitors while carrying out simulated sabotage tasks.

“These findings indicate that the Astra class models could evade our CoT monitors under adversarial conditions,” OpenAI said in its safety overview.

The company emphasized that the findings came largely from adversarial evaluations in which the model was pushed to evade monitoring. OpenAI said it has not found evidence that Astra uses steganographic chain-of-thought reasoning, in which hidden reasoning is concealed within seemingly unrelated text, and its broader evaluations found Astra less likely than GPT-5.6 Sol to violate safety and security restrictions.

OpenAI nevertheless said the results underscore the need for alignment-auditing techniques that do not depend solely on examining a model's chain of thought.

Astra's cybersecurity designation follows weeks of testing that OpenAI detailed ahead of the model's release.

Under the company's Preparedness Framework, a model can reach the Critical cybersecurity threshold when its capabilities include independently discovering previously unknown vulnerabilities and developing exploits against hardened real-world systems.

OpenAI said Astra achieved a perfect score on ExploitBench, a benchmark that measures exploit development from known vulnerabilities.

Because publicly available benchmarks can be affected by training-data contamination, OpenAI also created an internal evaluation using recently disclosed high-severity vulnerabilities. During those tests, Astra discovered and used two previously unknown zero-day vulnerabilities as part of an exploit chain, according to the company. OpenAI said it is disclosing those vulnerabilities to the affected maintainers.

In separate expert-led testing, Astra discovered previously unknown vulnerabilities in a hardened browser and assembled a chain of compromises that escaped the browser sandbox and executed commands on the host system. It also found multiple vulnerabilities in a hardened operating system and combined them into a privilege-escalation chain that moved from an unprivileged account to root access.

Those results led OpenAI to conclude that Astra had crossed the Critical threshold.

The company temporarily slowed development while strengthening protections around Astra and other high-capability models. In August, OpenAI said it had instituted a two-week pause in reinforcement-learning training on its latest deployment-bound models while it hardened research environments, expanded monitoring, and strengthened security logging.

The work came amid two separate concerns: preliminary evidence that Astra might reach the Critical cybersecurity threshold and the earlier OpenAI-Hugging Face security incident. OpenAI has said Astra was not involved in the Hugging Face incident.

The company subsequently imposed stricter security requirements on work involving Astra and other cyber models, including isolated testing environments, restricted network and tool access, stronger protection of model weights, sandboxed execution, and broader monitoring.

OpenAI also reports significant improvements in Astra's behavior.

In a simulation involving more than 54,000 internal Codex tasks, Astra generated roughly half as many flags for higher-severity misaligned behavior as GPT-5.6 Sol. The company also said Astra is substantially more resistant to jailbreaks and less likely to take potentially destructive actions in realistic browsing and professional computer environments.

That creates an unusual picture. Astra is simultaneously more capable of consequential cybersecurity work, better aligned overall, and, under some adversarial conditions, harder to monitor through its written reasoning.

The version being broadly released can perform defensive tasks such as secure code review and patching, but OpenAI said it will refuse more advanced requests such as creating proof-of-concept exploits for vulnerabilities. More capable cybersecurity access will initially be provided to a small group of testers and expanded through the company's Daybreak program for defensive use.

The restrictions illustrate the dual-use problem facing developers of increasingly capable cybersecurity models. The same system that can help a defender discover vulnerabilities, analyze malware, and patch software could potentially help an attacker find and exploit weaknesses more quickly.

OpenAI is therefore monitoring Astra not only by examining its chain of thought, but also by looking at its actions and the broader context of what an agent is doing. Its production monitoring system can inspect an agent's reasoning and behavior for signs that it is operating outside the user's instructions, such as accessing sensitive information without authorization or making destructive changes that were not requested.

If the system detects potentially serious misalignment, it can pause or terminate the activity. OpenAI acknowledges that those safeguards may sometimes interrupt legitimate work. That broader approach is significant because Astra demonstrates why chain-of-thought monitoring alone may not be enough.

As frontier models take on longer-running tasks with access to browsers, terminals, code repositories, and other tools, developers increasingly need to know not merely what answer a model produces, but what it is doing along the way.

Astra suggests that this becomes harder precisely when it becomes more important.

OpenAI's response is layered: stronger model alignment, tighter isolation and access controls, monitoring of both reasoning and actions, and restrictions on access to the model's most consequential cybersecurity capabilities.

Astra is therefore more than another step up in model performance. OpenAI is broadly deploying a system it believes can autonomously discover and exploit previously unknown vulnerabilities in hardened systems while acknowledging that, under deliberately adversarial conditions, the model can sometimes evade one of the techniques designed to monitor its reasoning.

The immediate story is that OpenAI has crossed its own Critical cybersecurity threshold.

The longer-term question is whether the industry's ability to understand and control increasingly autonomous models can keep pace with the models themselves.