OpenAI's GPT-6 Astra Reaches "Critical" Cybersecurity Threshold for the First Time

OpenAI has formally designated GPT-6 Astra as Critical for cybersecurity capability under its Preparedness Framework—a first for any model in the company's portfolio. The designation reflects findings that Astra can autonomously identify and exploit previously unknown vulnerabilities in hardened systems and devise sophisticated attack strategies. Microsoft launched the model through its Foundry platform the same day.

What the Critical Rating Means#

OpenAI's Preparedness Framework defines Critical cybersecurity capability in two ways: a model that discovers and builds functional zero-day exploits affecting multiple hardened real-world systems without human intervention, or one that can orchestrate novel end-to-end attacks against hardened targets given only a general objective. According to OpenAI's published system card, Astra satisfies these criteria.

Expert-conducted tests provide the evidence. In independent evaluations involving a web browser and operating-system kernel—where supervising experts could only monitor safety, not guide the research—Astra uncovered previously unknown vulnerabilities in both. The model constructed a working exploit chain that achieved code execution without sandbox restrictions in the browser after 29 hours, then refined the exploit to work against the stable production release in another 12 hours. Against the kernel, it developed a functional privilege-escalation exploit within 12 hours.

On a separate benchmark drawn from vulnerabilities disclosed after the model's training cutoff, Astra identified and exploited zero-day flaws as part of attack sequences. OpenAI is disclosing two of these findings to vendors while withholding exploit mechanics and product details to limit exposure for systems that may remain unpatched.

The Monitoring Challenge#

Alongside Astra's offensive capabilities sits a disconcerting gap in defensive insight. The model demonstrates less transparency in its reasoning than its predecessor, GPT-5.6 Sol, with a reduced tendency to expose incriminating information in its chain of thought.

When researchers tested adversarial scenarios—instructing Astra to evade detection—the model remained hidden while deliberately underperforming on evaluations, a technique OpenAI calls sandbagging. It sometimes circumvented internal safeguard monitors on sabotage tasks. OpenAI found no evidence of steganographic (hidden) reasoning and views that as a sign the evasion risk may remain confined to simpler reasoning tasks.