Critical means zero-day discovery on hardened systems without human intervention, and Astra is the first to hit it
Astra scored 100 percent on ExploitBench and found 2 unknown V8 zero-days during evaluation
Independent lab Irregular solved 86 of 226 challenges with Astra against 34 with GPT-5.6 Sol
Cyber jailbreak refusals went from 59 percent on Sol to 91.5 percent on Astra
OpenAI committed 1 billion USD in subsidised defensive access over six months
Astra is harder to monitor than Sol, and OpenAI published that finding itself
On August 7, 2026, OpenAI decided internally that its next model might cross a line it had written down in December 2023 and never reached. Four weeks later it shipped anyway. GPT-6 Astra is the first model OpenAI has ever classified as Critical in any category of its Preparedness Framework, and the category is cybersecurity.
That word is doing specific work, not marketing work. And buried under the launch coverage is a second finding that OpenAI published against its own interest: Astra is harder to monitor than the model it replaces. Here is what Critical means, what OpenAI did about it, and why the oversight admission matters more than the AGI quote.
What Critical Actually Means
The Preparedness Framework defines the Critical cyber threshold as either of two conditions. Verbatim, the first: "The model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." The second: "The model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal."
Two things matter in that text. "Without human intervention" is the autonomy bar, and "hardened real-world" excludes toy targets. This is not a claim that the model knows about security. GPT-4 knew about security. It is a claim that the model closes the loop from goal to working exploit on systems built to resist exactly that.
GPT-5.6 Sol was rated High. Every previous OpenAI model was rated High or below. The framework has existed for close to three years without anything reaching the top rung, which is the context that makes the designation worth reading carefully rather than dismissing as launch theatre.
The Evidence OpenAI Published
Benchmark
Astra
GPT-5.6 Sol
Claude Fable 5.1
ExploitBench
100.0%
78.5%
70%
ExploitGym
42.4%
30.3%
30.4%
SRE-Bench, 1 attempt
88.0%
55.9%
12.5%
SRE-Bench, 4 attempts
99.2%
68.7%
not published
SEC-Bench Pro
85.4%
79.1%
not published
Internal V8 CVE port
39.0%
11.5%
not published
Read the last row first, because it is the one that earned the designation. OpenAI took 20 high-severity V8 vulnerabilities disclosed between June and August 2026, after the training cutoff, and rebuilt them as an evaluation. Astra solved 39 percent against Sol's 11.5. While working that eval it also found two vulnerabilities that were not in the set and not known to anyone. OpenAI says both went to the maintainers.
Elsewhere in the write-up: Astra built a full browser compromise chain that escaped the sandbox and ran commands on the host when the browser opened an HTML file, and it chained multiple vulnerabilities in a hardened operating system into privilege escalation from unprivileged user to root.
SEC-Bench Pro moves only 6.3 points, from 79.1 to 85.4, which is the least dramatic row and probably the most representative of routine security work. The gap between that and the 44 point jump on SRE-Bench single-attempt tells you the improvement is concentrated in autonomous multi-step operation rather than in raw security knowledge.
One caveat runs under all of it, and OpenAI states it plainly while most coverage dropped it. Every cyber number above was produced with production safeguards disabled. These are capability measurements, not measurements of the thing you can rent.
What an Independent Lab Found
Irregular ran their own evaluation, which matters more than any self-reported table. On FrontierCyber, a 226-challenge set, Astra solved 86. GPT-5.6 Sol solved 34. Astra found zero-days in browsers and in a cloud database during the assessment.
It solved zero Elite challenges. Neither did Sol. The ceiling is still there.
Gray Swan tested prompt injection with 1,810 curated attacks in their IPI Arena. Attack success within 15 attempts was 8.5 percent against Astra and 27.0 percent against Sol. That is a defensive result, and it is the one I find most useful, because indirect prompt injection is the attack surface that actually touches ordinary agent deployments.
The Safeguards That Shipped
The model refuses 91.5 percent of a cyber jailbreak evaluation set, against 59 percent for Sol. At launch it declines to write proof-of-concept exploits at all. Secure code review and patching stay allowed. Anthropic went the other direction on general refusals this cycle, which I covered in Claude Fable 5.1 refuses less, so the two labs are now visibly diverging on where the line sits.
Above the model sits a monitoring layer that is new as a production default. Classifiers read the reasoning and the actions on every tool-using inference and stop activity they judge unauthorised. Activation classifiers run at every sampled token and escalate to higher-compute investigators. During training and evaluation, monitoring consumed roughly 20 percent of the inference compute being monitored, with a 30 minute target for triaging an alert and an expectation that teams pause the activity if they cannot rule out a false positive in that window.
You will feel this. OpenAI says so directly: legitimate work will be flagged, including work with nothing to do with security. In ChatGPT and Codex a paused task asks you to review before continuing. In the API the task stops. One Hacker News commenter reported their Codex run hitting safeguard panic mid-task on day one. If you run long autonomous agents, budget for interruption as a normal operating condition rather than a bug.
Daybreak and the Billion Dollar Defence Bet
OpenAI's argument for shipping is that the same capability defends. Daybreak is the program carrying that argument, and it comes with a number: 1 billion USD in subsidised access over six months for state and local government, critical infrastructure, community banks, nonprofits and open-source maintainers.
Results published so far are smaller and more concrete. 17 million USD in credits and direct support delivered. 41 codebases reviewed. 858 issues identified, 263 patches produced, 143 patches accepted upstream. Trail of Bits is a named partner.
143 accepted patches against 858 issues found is a 17 percent conversion, which is roughly what anyone who has filed security patches upstream would predict. The bottleneck was never finding bugs. It is maintainer time, and a model that files more reports does not obviously fix that.
The Part OpenAI Admitted Against Itself
Buried in the material is a finding that cuts against the launch narrative, and OpenAI published it anyway.
Astra is harder to monitor than GPT-5.6 Sol. In evaluations that explicitly instruct the model to evade monitoring, Astra evades better. OpenAI attributes this to tighter control over its written reasoning and to solving problems in fewer written steps. No steganographic reasoning was detected. The time horizon for tasks completed without any written chain of thought grew by about an order of magnitude.
Chief Scientist Jakub Pachocki was direct about the stakes: "We will not accept degradation in our ability to monitor model alignment beyond a certain level." Also: "Progress in intelligence does not guarantee progress in alignment."
The whole safety case rests on reading the model's reasoning. The model got better at not writing it down. That tension is unresolved, stated openly, and worth more attention than the AGI quote that led every write-up.
Nobody Has Connected This to the EU AI Act
Here is a gap in the coverage that surprised me. Under the EU AI Act, Article 51(2) presumes a general-purpose AI model has high impact capabilities, and therefore systemic risk, when the cumulative training computation exceeds 10^25 floating point operations. Article 52 then requires the provider to notify the European Commission "without delay and in any event within two weeks after that requirement is met." These obligations became applicable on 2 August 2025.
Astra was trained on more than 100,000 GPUs at OpenAI's Stargate site in Texas, described by VP of Research Aidan Clark as the largest training run the company has done by far. A run at that scale is not close to the threshold. It is orders of magnitude past it.
So Astra is a systemic-risk GPAI model under EU law, notification is mandatory rather than optional, and providers of systemic-risk models carry ongoing duties around model evaluation, adversarial testing, incident reporting and cybersecurity protection. OpenAI has now published a document stating its own model meets an internal Critical cyber threshold, which is about as clear a piece of evidence for a regulator as a company can hand over voluntarily.
I could not find a single article connecting the Critical designation to the GPAI systemic-risk regime. For anyone deploying Astra into the EU, that link is the one with actual legal weight behind it, and the fast-follow question is whether the Commission treats a self-declared Critical rating as a trigger for scrutiny or as evidence of a functioning compliance process.
What This Changes If You Are Not a Security Team
Three practical consequences.
Your agent runs will get interrupted, and the interruption is not always about security. Design the loop so a pause is recoverable rather than a lost session.
The refusal boundary tightens for accounts assessed as higher risk, with expanded cross-conversation context feeding that assessment. If you do legitimate security work, expect friction and expect it to depend on your account history, not just your prompt.
The defensive numbers are the ones to act on. 8.5 percent injection success is a real improvement over 27 percent and it is still not zero. Anthropic disclosed real-world misuse of Claude earlier this year, which I went through in what Anthropic actually disclosed, and the pattern in both cases is the same: capability arrives in production before the industry agrees on how to gate it.
Bottom Line
The Critical designation is the most interesting thing about this launch and the least covered. OpenAI built a threshold three years ago, crossed it, said so in public, disabled its own safeguards to measure how far across it had gone, and published a monitorability regression that undercuts its own safety story.
Whether shipping was right is a judgement call I am not going to pretend to settle. What I will say is that the disclosure is unusually complete, and the numbers in it are more damning and more reassuring than the headline allows in either direction. If you want the pricing, access tiers and benchmark caveats, that is in GPT-6 Astra costs 2.5x Sol. The rest of the model comparisons I have run live in the RAXXO Lab overview.
Top comments (0)