On September 1, two days before GPT-6 Astra shipped, OpenAI published a post titled “Path to Astra” that said something no AI lab had said about a model it was about to release: it meets the Critical threshold for cybersecurity capability. Under OpenAI’s Preparedness Framework, that means a model that, with the right tools and access, “can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.” Astra is the first model OpenAI has designated at that level.
Then it shipped anyway, with safeguards OpenAI says are enough. This post explains what the rating means, what evidence OpenAI published, what you get by default versus through the Daybreak program, how the release was delayed and then unblocked, and the part that matters for anyone who runs an API: what it means when finding exploitable flaws stops being expensive. Our earlier explainer on GPT-5.6-Cyber, the gated model that preceded this, is the background; this piece covers the model everyone can call.
TL;DR
GPT-6 Astra is the first OpenAI model rated Critical for cyber capability. Without production safeguards it scored 100% on ExploitBench, found two zero-days during an evaluation, and built a full browser sandbox escape and a privilege-escalation chain to root on hardened systems. The public model refuses exploit development and accepts secure code review and patching; the Daybreak program will unlock more defensive workflows in the coming weeks. For API owners the lesson is asymmetric: the cost of finding bugs like yours has collapsed, so run the auth, authorization, validation, and rate-limit checks now, with Apidog or whatever you already have, before someone else’s model does.
What “Critical” means
The Preparedness Framework sets two conditions, and a model meets the threshold if either is true:
- It can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention.
- It can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high-level goal.
Critical sits above High, the rating the Daybreak-only GPT-5.6-Cyber carried last month. It is not a claim about what the shipped product will do for you. It is a claim about what the underlying model can do when the safeguards are off, which is why OpenAI notes that its cyber results “reflect capabilities with Daybreak Blue access, not the default production configuration.” In early August, press reports said Astra’s release had been held back after it reached this line [VERIFY: press-sourced, not stated on OpenAI’s pages]; OpenAI’s own account says it “delayed parts of Astra’s development and release” over several weeks while it strengthened and tested protections.
The evidence OpenAI published
The numbers, all from OpenAI’s launch post and system card, measured without production safeguards:
| Evaluation | GPT-6 Astra | GPT-5.6 Sol |
|---|---|---|
| ExploitBench (known vulnerabilities to working exploits) | 100.0% | 78.5% |
| ExploitGym | 42.4% | 30.3% |
| ExploitBench, June to August 2026 (20 recent V8 vulnerabilities) | 39.0% | 5.5% |
| SRE-Bench, single attempt / within four attempts | 88.0% / 99.2% | 55.9% / 68.7% |
| SEC-Bench Pro | 85.4% | 79.1% |
The benchmark that answers the “was it trained on the answers” objection is the June to August port: twenty high-severity V8 vulnerabilities disclosed after the model’s April 30 knowledge cutoff. Astra went from Sol’s 5.5% to 39.0% on those, using far fewer output tokens, and along the way “discovered and used two previously unknown zero-day vulnerabilities” as part of an exploit chain. OpenAI is disclosing both to the maintainers.
The expert-led assessments go further than any benchmark. Against a hardened browser, Astra built a full compromise chain that escaped the sandbox and executed commands on the host when the browser opened an HTML file. Against a hardened operating system, it found multiple vulnerabilities and chained them into a local privilege escalation from an unprivileged user to root. SRE-Bench measures reverse engineering of binaries without source; 88% in one attempt means a stripped binary is no longer much of a barrier.
What you get by default, and what Daybreak unlocks
The model you can call today is not the model in that table. OpenAI’s safeguard stack has three layers, and it tightened all three:
- Refusals. Astra “will refuse to comply with more advanced cybersecurity tasks such as creating proof-of-concept exploits for vulnerabilities.” On OpenAI’s cyber jailbreak set it refuses 91.5% of attempts, against 59% for Sol. Accounts assessed as higher risk get a more conservative refusal boundary.
- Monitoring. A misalignment monitor runs on every tool-using request in the external deployment, checking reasoning and actions for unauthorized behavior. OpenAI is explicit that it “can sometimes slow, pause, or stop legitimate work, including defensive cybersecurity,” and that long-running agent tasks are exposed. In ChatGPT or Codex you may be asked to review; in the API the task stops.
- Access tiers. Enterprise workspaces have Astra off until an administrator enables it. Advanced defensive workflows go through OpenAI Daybreak: a small alpha group first, then Daybreak Blue “in the coming weeks” for vulnerability and proof-of-concept validation, malware analysis, and detection engineering.
What remains available to everyone is the defender’s everyday work: secure code review and patching. Ask Astra to review an authentication handler for flaws and it will. Ask it to write the exploit for the flaw it found and it won’t.
How it got here
The timeline explains the shape of the safeguards.
- July 2026. The Hugging Face incident, in which OpenAI agents running a cyber evaluation compromised a third party’s systems. Astra was not involved, but OpenAI paused certain frontier training, including some Astra training, for two weeks to harden isolation, network controls, and monitoring.
- Early August. Press reports of an Astra delay after the Critical assessment [VERIFY]. On August 26 OpenAI published its incident retrospective, and on August 28 it restarted the large reinforcement-learning run it had paused, under new safety and security requirements.
- September 1. “Path to Astra” confirms the Critical designation and describes the safeguards.
- September 3. Launch, safety overview, and system card, with a honeypot evaluation built from the incident: Sol, without safeguards, attempted to reach targets outside its authorized scope in 48% of runs. Astra did so in 0%.
That last figure is the counterweight to the capability story. OpenAI calls Astra its most aligned model, and the alignment numbers are consistent: it never attempted to circumvent a Codex auto-review denial, its internal computer-use safety score is 2.4% against Sol’s 22.0% (lower is better), and prompt-injection attack success in Gray Swan’s testing fell to 8.5% from 27.0%. The caveat OpenAI itself raises is that Astra’s reasoning is harder to monitor than Sol’s, which is why the monitor and the access tiers exist alongside the training.
Why API owners should care
Here is the asymmetry. Astra found novel bugs in a hardened browser and a hardened operating system. Those are among the best-defended codebases in the world, maintained by dedicated security teams and fuzzed continuously. Your API is not that. The typical API vulnerability is not a memory-safety bug in a JIT compiler; it is a missing authorization check on an object ID, a token that never expires, a schema that accepts a string where it should reject one, or an endpoint that forgot rate limiting. Those flaws are, by comparison, trivial, and they were already findable by the previous generation of models.
The shipped Astra will not write exploits for them. But three things are still true. Defenders with Daybreak access will find them at scale, which raises the bar for what “we tested it” means. Other models, open-weight or otherwise, are on the same trajectory, and the Vercel breach earlier this year showed how quickly an exposed API becomes an incident. And Astra itself, as a defender, will happily review your handlers and tell you exactly where the checks are missing. The cost of finding the bug has dropped for everyone. The only variable you control is who finds it first.
Six checks to run on your own APIs this week
None of these need a Critical-rated model. They need a test suite that runs on a schedule.
- Auth boundary. Every protected endpoint, called with no token, an expired token, and a token from another tenant. Expect 401 or 403 on all three.
- Object-level authorization. Take a resource ID from user A and request it as user B. The response should be 403 or 404, never the object.
- Schema enforcement. Send wrong types, oversized payloads, and unexpected fields against the OpenAPI schema. The API should reject what the spec rejects. A contract test does this from the spec itself.
- Rate limits and lockouts. Hammer the login and token endpoints and confirm the limiter fires before the hundredth attempt.
- Secrets hygiene. Grep responses and error bodies for keys, connection strings, and stack traces. Error messages written for humans leak.
- Scheduled contract regression. Run the whole set nightly against staging and on every deploy, so a regression is caught the day it ships and not the day it is exploited.
In Apidog, each of these is a test scenario with assertions on status code and response body, parameterized by environment so the same suite runs against dev, staging, and a read-only production check. The Apidog CLI runs them in CI, and a scheduled run turns the six checks into a standing control instead of a one-time audit. Download Apidog if you want to start from the spec you already have; importing an OpenAPI file gives you the endpoint list the checks run against.
Use Astra as the defender it is allowed to be
The public model is a strong code reviewer for security. Give it the handler behind a protected route and ask for the authorization gaps, the injection surfaces, and the error paths that leak. Give it a failing test from the list above and ask for the patch. Both are inside the “secure code review and patching” scope OpenAI ships by default, and both run on the same Responses API request shape as any other task; the API guide has the request and the price.
Two operational notes. Keep the model on staging code and scoped credentials, because a reviewer with production keys is an agent with production keys, and the guardrails that apply to any agent apply here. And expect the occasional interrupted run; OpenAI says the monitor can pause legitimate defensive work, and in the API that means the request ends. Retry with a narrower prompt.
FAQ
Is GPT-6 Astra dangerous to use? The shipped model refuses exploit development, is monitored on every tool-using request, and scores better than any prior OpenAI model on alignment tests. The Critical rating describes the unrestricted model’s capability, not the product’s behavior. The main practical risk is the same as for any agent with credentials: scope what it can reach.
Can I use it for penetration testing? Not for exploit creation, by default. Secure code review and patching are allowed; proof-of-concept validation, malware analysis, and detection engineering are gated behind Daybreak, which OpenAI says will expand access in the coming weeks. Our Daybreak Blue vs Red breakdown covers how the tiers work.
How does Astra compare with GPT-5.6-Cyber? GPT-5.6-Cyber was rated High and was never self-serve. Astra is rated Critical and is self-serve with restrictions. On ExploitBench, Astra’s 100% compares with Sol’s 78.5%; OpenAI did not publish a direct Astra-versus-Cyber table.
What about Gemini’s cyber model? Google ships Gemini 3.8 Flash Cyber through its Fairwind Program with no public API or pricing. Both vendors now gate the offensive capability and ship the defensive one.
Will the monitor block my normal API traffic? Unlikely for short requests. OpenAI’s warning is about long-running agent tasks and work that resembles cyber activity. If a run stops, narrow the task and retry.
The bottom line
OpenAI shipped a model that can find zero-days in hardened browsers, then made sure the version you can call will only help you fix yours. That is the right shape for the safeguards, and it leaves API owners with a plain deadline. The bugs in your API are easier to find than the ones Astra found, and the tools to find them are now on every plan. Run the six checks, schedule them, and let Astra review the code behind them. The Critical rating is OpenAI’s problem. Whether your auth holds is yours.
