When GPT-6 Astra shipped on September 3, the headline was that OpenAI rated it Critical for cybersecurity, the first time it has ever given a model that rating, and chose to gate the dangerous capability rather than release it openly. A lot of coverage treated "Critical" as a vibe. It is not. It is the output of a structured process for deciding when a model is too dangerous to ship as-is, and understanding that process is genuinely useful, because this kind of capability-gating is going to become normal and you will keep seeing these ratings. Here is how it actually works, in plain terms.
The core idea: capability thresholds, not just "is it safe"
The framework OpenAI and other labs use does not ask the vague question "is this model safe." It asks a sharper one: "does this model cross a defined capability threshold in a domain we consider dangerous." Cybersecurity is one such domain (others include things like bio and autonomy). Each domain has tiers, roughly escalating from low to high to critical, defined by what the model can do, not how it feels.
So "Critical for cybersecurity" is not a mood. It is a claim that the model crossed a specific, pre-defined capability line, in this case, the ability to autonomously find zero-day vulnerabilities in hardened systems and turn them into working exploits without human guidance. That is a bright-line capability, and the model reportedly cleared it.
Why the threshold triggers action, not just a label
The point of defining thresholds in advance is that crossing one is supposed to force a response, before the model ships, not after something goes wrong. That is exactly what played out with Astra:
- An internal evaluation showed the model performing well enough at autonomous cyberattacks that OpenAI could not rule out having crossed its Critical threshold.
- Crossing that line triggered a pause on parts of the work while the company strengthened isolation, internet controls, action monitoring, and alignment.
- Development resumed after those mitigations, and the model shipped with the dangerous capability gated rather than open.
The sequence is the whole value of the framework: define the dangerous line ahead of time, evaluate against it honestly, and let crossing it mandate specific safeguards. Without pre-defined thresholds, "is it too dangerous" becomes a judgment call made under launch pressure, which is exactly when you do not want to be inventing the standard.
What "gated" means as a mitigation
Rating a capability Critical does not automatically mean "do not ship." It means "do not ship this capability openly." Astra's general intelligence is available; the zero-day capability ships behind split, controlled access. This is the framework working as intended: it separates the dangerous slice from the useful whole and applies controls proportional to the risk, rather than the blunt choice of ban-it-all or ship-it-all.
Why this matters even if you never touch model safety
You are not running these evaluations. So why care? Two reasons that are directly practical:
- These ratings are becoming a signal you should read. When a model ships with a Critical cyber rating, that is public information about what capabilities now exist in the world, gated or not. It is an input to your own threat model. "A model that can autonomously find zero-days exists as of September 2026" is a planning fact, and the rating is how you learned it.
- The pattern is coming to your own AI governance. The idea of defining capability thresholds in advance, evaluating against them, and gating what crosses the line is not just for frontier labs. Any organization deploying capable AI against real systems will eventually need its own version: what is this agent allowed to do, at what capability does it require human gating, what is the pre-defined line that changes the rules. The framework labs are using is a preview of the governance every AI-using company will need.
The take
"Critical for cybersecurity" is not a marketing adjective, it is the result of a defined process: name the dangerous capabilities in advance, set thresholds, evaluate honestly, and let crossing a line force specific safeguards, up to and including gating the capability away from open release. Astra is the first model to trip the cyber threshold, and watching how OpenAI handled it, pause, mitigate, resume, ship gated, is a preview of how capable-but-dangerous AI gets released from here. It is also a template for the governance your own organization will need the day it puts a capable model near anything that matters.
Does your organization have any pre-defined line for what an AI system is allowed to do before a human has to step in, or is it still decided case by case under pressure? That "we'll know it when we see it" gap is exactly what capability thresholds are meant to close.
Top comments (0)