Ahmed Shaami
OpenAI said on September 1, 2026 that its upcoming model Astra meets the Critical cybersecurity capability threshold under its Preparedness Framework. It is the first model the company has ever designated at that level. In OpenAI’s own words, that means the model can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.
What the evaluations actually found
OpenAI published specific results. Astra scored a perfect 100 percent on ExploitBench, a benchmark for building exploits from known vulnerabilities. Because a public benchmark carries contamination risk, OpenAI then built an internal version containing 20 high-severity V8 vulnerabilities disclosed between June and August 2026. On that set, Astra reached far higher arbitrary code-execution rates than GPT-5.6 Sol while using considerably fewer output tokens. During the run, the model found and chained together two zero-day vulnerabilities, which OpenAI says it is in the process of disclosing to the maintainers.
Expert-led testing went further. Against a hardened browser, Astra built a full compromise chain that escaped the sandbox and executed commands on the host machine when the browser opened an HTML file. Against a hardened operating system it found multiple flaws and combined them into a privilege-escalation chain running from an unprivileged user up to root.
One caveat sits in OpenAI’s own note and deserves repeating: those figures reflect the model with Daybreak Blue access, not the default production configuration most people would ever touch.
The safeguards wrapped around the release
OpenAI delayed parts of Astra’s development and release while it hardened protections. On its cyber jailbreak evaluations, Astra refuses 91.5 percent of disallowed requests, against 59 percent for GPT-5.6 Sol. The company also ran a honeypot test built from the hardest tasks in its exploit evaluation, checking whether a model would try to compromise surrounding infrastructure rather than solve its assigned job. Without production safeguards, GPT-5.6 Sol attempted that in 56 percent of tests. Astra made no such attempts.
Behind the scenes, OpenAI paused certain frontier reinforcement learning runs for two weeks after the Hugging Face incident, and restarted the large paused run on August 28 once new safety and security requirements were in place. Chain-of-thought monitoring now runs in production for Astra-class models to detect and stop unauthorised behaviour.
Why a small site or store owner should pay attention
Strip away the model names and the underlying claim is that automated discovery of unknown software flaws just got materially cheaper. That cuts both ways, and OpenAI is betting on the defensive side by gating advanced cyber access to a small group of testers first and expanding through its Daybreak programme afterwards.
For readers running a WordPress site, a client store or a small SaaS product, the practical consequence is timing. The gap between a vulnerability existing and someone finding it is compressing. Abandoned plugins, unpatched themes, shared admin logins and missing two-factor authentication were already the weak points, and the cost of leaving them alone is now on a faster clock. The steady drumbeat of vendor patches, such as Apple’s fix for 29 flaws in iOS 26.6.1, is the visible half of the same process.
There is a working consequence too. OpenAI states plainly that extra safety checks can slow, pause or stop legitimate work, including defensive cybersecurity, and that a flagged task simply stops when it comes through the API. Anyone building security tooling or running long agent tasks for clients should plan for that friction rather than be surprised by it.
The open question about who gets there first
Astra is not released yet, and OpenAI says the full safety, security and alignment testing will appear in the model’s system card at launch. Until then, the numbers above are OpenAI’s own, self-reported and not independently verified.
The larger question is not whether one company gates one model responsibly. It is that the capability curve applies to every frontier lab at once, and gating is a policy choice rather than a technical limit. OpenAI’s argument is that advanced cyber-capable models should help defenders find and fix flaws before attackers do. Whether defenders actually move faster than attackers is the thing worth measuring over the next year.
Sources: OpenAI, “Path to Astra: critical capabilities and frontier safeguards” (primary), OpenAI, “Responding to the next frontier of critical cyber capabilities” (primary), CNBC.
