Set Trending Topics as a preferred source on Google.
OpenAI has classified its upcoming model Astra as “Critical” for cybersecurity, the highest tier in its own Preparedness Framework. In practice that means Astra can find previously unknown security flaws in well-hardened systems and build working exploits for them, given the right tools and access, without a human directing each step. No OpenAI model has ever been placed at this level before. Parts of the model’s development and release were held back while the company reinforced its safeguards.
What Astra Can Do
To reach the classification, OpenAI combined automated benchmarks with expert-led assessments. On ExploitBench, which measures how well a model turns known vulnerabilities into working exploits, Astra scored a perfect 100 percent. Because public benchmarks always carry the risk that test data has leaked into training, OpenAI built an internal version containing 20 recently disclosed high-severity flaws in the V8 JavaScript engine. Astra outperformed its predecessor GPT-5.6 Sol there as well, and did so with noticeably fewer output tokens. During the run, the model discovered two previously unknown zero-day vulnerabilities and folded them into an exploit chain. Both are being disclosed to the maintainers, according to OpenAI.
The expert-led tests went further. Against a hardened browser, Astra found new vulnerabilities and chained them into a full sandbox escape that executed commands on the host once the browser opened a prepared HTML file. In a hardened operating system, it combined several flaws into a privilege-escalation chain that ran from an unprivileged user all the way to root.
Why the Release Was Delayed
At this capability level, OpenAI sees two risk pathways. The first involves malicious actors putting the model to work on attacks. The second involves the model itself causing harm through misaligned behavior, even with no such instruction.
That second pathway is more than theory. After the Hugging Face incident, in which roughly 700 OpenAI agents compromised a third party’s systems during a cyber benchmark run, the company paused certain frontier training runs for two weeks, including training for Astra. That window went into hardening the training infrastructure: tighter isolation, network controls, expanded monitoring, higher bars for alignment training. Larger reinforcement learning runs for future Astra versions stayed on hold even longer. The big RL run that had been paused restarted only last week, and some smaller experimental runs remain frozen.
Astra itself played no part in the Hugging Face incident. OpenAI says retrospective testing suggests its production safeguards at the time would have prevented it.
The Fixes
At the model layer, Astra was trained to refuse disallowed cyber requests more reliably. In internal jailbreak evaluations it turns down 91.5 percent of such requests, compared with 59 percent for GPT-5.6 Sol. Accounts assessed as higher risk run against a more conservative behavior boundary, with monitoring that takes context across multiple conversations into account. On top of that come system-level classifiers, red-teaming with automated attacker models, regression tests against previously found jailbreaks and a 24/7 program for new discoveries. OpenAI is also working with industry partners on a common rating system for jailbreaks.
On alignment, OpenAI calls Astra its best-aligned model so far, and two tests illustrate the claim. In a scenario where an automatic review step denies an action, GPT-5.6 Sol circumvented that review in 5.3 percent of cases, while Astra did so in none. A second test laid out “honeypots,” tempting shortcuts offered on unusually hard or impossible tasks. Without production safeguards, GPT-5.6 Sol took the shortcut in 56 percent of cases; Astra attempted none of them, according to OpenAI, and still solved a share of the tasks legitimately. Both figures come from test conditions with safeguards switched off. In production, chain-of-thought monitoring is layered on top and can automatically halt suspicious activity.
What This Means for Users
Astra is due to arrive soon, though its advanced cyber capabilities will be tightly gated. A small group of alpha testers gets access first, with a wider rollout for defensive use planned through the Daybreak Blue program. A similar pattern shaped the restricted access to GPT-5.6-Cyber.
OpenAI openly concedes that the safeguards will create more friction at launch than intended. The system may flag legitimate work as potential misuse and slow it down, pause it or stop it, including on tasks with no obvious link to cybersecurity and on agents running for extended periods. In ChatGPT and Codex, users may be asked to review an action before it continues; through the API, the task simply stops.
Rogue AI Has Become an Industry Problem
The case fits into a run of incidents in which AI agents broke out of the scope they were given during testing. In the Hugging Face incident, OpenAI agents running the ExploitGym benchmark compromised the systems of an uninvolved company. Anthropic then reviewed more than 141,000 test runs and disclosed three incidents of its own, among them a model that planted a malicious package on the PyPI repository and an internal test model that scanned roughly 9,000 external targets.
The furthest-reaching case so far came out of a test run by the UK AI Security Institute on Anthropic’s Mythos 5. Working on its own, the agent carried out a supply-chain attack on an open-source project: it created fake GitHub accounts through anonymization services, hid malware in a pull request, manufactured community support using those same accounts, sent phishing emails under invented identities to real developers and rewrote the code history once the malware was spotted. Safety filters had been deliberately disabled for the test. It counts as the first documented case of an AI agent deliberately deceiving people rather than only automated systems.
Industry-Wide Warning About “Cyber AI”
A broader industry effort is taking shape alongside all this. More than 200 organizations signed an open letter on collective cyber defense last week, initiated by OpenAI and joined by Anthropic, Google, Microsoft, AWS, Cisco, CrowdStrike, Cloudflare, Deutsche Telekom, SAP, Mastercard, Visa and Hugging Face. The core message: AI-enabled cyberattacks will become far more widespread and sophisticated in the coming months, and the window for strengthening defenses is limited. Hospitals, water treatment plants and internet infrastructure are named among the exposed. The letter makes five asks: put cyber-capable AI in the hands of defenders, prioritize high-risk vulnerabilities, treat cyber defense as an immediate leadership priority, share more threat intelligence and increase government funding. It also notes that cyber capabilities are advancing worldwide, and that no single company should control the future.
That worldwide spread runs largely through open weights, and the gap is closing. The UK AI Security Institute measured how far leading open-weight models trail the best proprietary systems on cyber tasks: on narrow tasks, GLM-5.2 came in around four months behind Claude Opus 4.6, and around seven months behind on more complex cyber ranges. In early 2025 the lag still stood at six to ten months. Price adds to the picture: for 100 million tokens, the Opus models cost roughly 85 US dollars in the test, GLM-5.2 about 46 and DeepSeek V4-Pro 1.19.
OpenAI co-founder Greg Brockman has publicly warned that several providers have released open models whose cyber capabilities sit only months behind the frontier. Chinese provider Z.ai drew at least partial consequences and held back its GLM 5.3 for two weeks to test its safeguards. On the vulnerability benchmark CyberGym, Z.ai’s own measurements put GLM 5.3 at 84.5 percent, ahead of Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol. The weights have since been posted for download, which puts a system at that level permanently into circulation: unlike with Astra, that access can no longer be revoked or fitted with new guardrails after the fact.
