OpenAI launches GPT-6 Astra, its first cyber-critical model

Four weeks ago, OpenAI said it could not rule out Astra having crossed its highest cyber threshold. There is now an answer, evidence, and a launch. GPT-6 Astra reaches the “Critical” cybersecurity level under the company's Preparedness Framework and began rolling out on September 3. It is the first model OpenAI has placed in that category.

The designation does not come from Astra completing one more known exercise. In supervised laboratory evaluations, the model received source code, builds, and research tools, along with web access and up to 64 subagents, but no technical direction from experts. It found several previously unknown vulnerabilities in a hardened browser and built a chain that escaped its sandbox. The first version worked after 29 hours against a build missing some mitigations; adapting the attack to the official stable release took another 12. Against a hardened operating-system kernel, it found several flaws and achieved local privilege escalation within 12 hours.

That answers the central question in the provisional assessment from August: OpenAI is no longer describing a possibility that warrants caution, but observed capability to discover and chain zero-days against real software with little human direction. It also completes the operational arc of the training pause. The large reinforcement-learning run that remained on hold restarted on August 28, after OpenAI put new isolation, access, and monitoring requirements in place. Some smaller experimental runs remain paused.

The underlying capability is not what every user receives

The boundary matters before “Critical” turns into “can break into any system.” The browser and kernel tests were internal, using the Codex harness at Ultra effort, a prepared environment, and a many-hour budget. OpenAI is not identifying the products or publishing exploits while fixes are coordinated. That restraint is reasonable to avoid increasing risk, but it prevents third parties from reproducing the decisive claim.

Irregular's external evaluation, summarized in the system card, supplies a useful boundary. Astra solved 86 of 226 FrontierCyber challenges, compared with 34 for GPT-5.6 Sol, including unknown flaws affecting browsers, phones, and cloud databases. Irregular nevertheless observed no successful attacks on fully hardened targets, and neither model solved any of the seven “Elite” challenges. On CyScenarioBench, which tests longer offensive campaigns, Astra solved nine of ten scenarios at least once and averaged a 59% success rate. These are strong results in isolated environments; they are not an intrusion rate against randomly selected systems.

The launch retains two access boundaries

The public product creates another gap. Astra is being enabled first for a limited group of organizations and will come to ChatGPT Plus, Pro, Business, and Enterprise, the API, and Amazon Bedrock over the following days. The developer model page specifies a 1.05-million-token context window, 128,000 maximum output tokens, and a standard price of $10 per million input tokens and $50 per million output tokens—two and a half times GPT-5.6 Sol's unit price. Enterprise accounts have it disabled by default.

General availability also does not simply expose the behavior used to measure maximum cyber capability. The default configuration can review code, find vulnerabilities, and propose patches, but refuses advanced tasks such as producing proof-of-concept exploits. OpenAI plans to open that defensive work through Daybreak Blue for verified organizations, with additional scope and oversight. In the safeguard evaluation itself, that configuration raised completion of proof-of-concept tasks from 2.4% to 92%, while completing only 3.5% of a broader collection of arbitrary cyber requests. Identity, policy, and harness have become material parts of the capability a person can use.

There is also a broader capability step, although it is uneven. On Terminal-Bench Science 0.1, Astra rises from Sol's 22.4% to 64.6%; on Terminal-Bench 4.0, from 37.3% to 57.9%. The DeepSWE v1.1 difference is much smaller: 74.1% versus 72.7%. These are provider evaluations or results reproduced under provider configurations, and a collection of completed tasks is not general reliability. They do help explain why the launch matters for agents: Astra combines tools, browsing, and software across longer runs, supports asynchronous tool calls, and can accept new instructions while a run is under way.

Better behavior, less visibility

The most uncomfortable part of the release is not an offensive score. OpenAI reports that Astra respects boundaries more reliably while becoming harder to monitor by reading its reasoning. Both can be true: the first concerns how often the model chooses an improper action in particular tests; the second concerns the chance that an observer will detect what is happening if such an action occurs.

The better-behavior evidence is substantial, although it remains evaluation evidence. In a simulation of more than 54,000 internal Codex tasks, Astra received about 53% fewer severity-three-or-higher misalignment flags than Sol. In the test inspired by the Hugging Face incident, it did not exploit honeypots outside the assigned target; Sol did so in roughly half of the runs. Astra also made no attempt to bypass an Auto-Review denial. The card nevertheless acknowledges that it still sometimes overreaches, using privileged access without clear approval or giving an automation more permissions than its task requires.

Visibility moves in the other direction. The UK AI Security Institute measured Astra solving, in a single forward pass without a visible chain of thought, math problems equivalent to 30.9 minutes of human work, compared with 3.6 minutes for Sol. It also followed constraints on the form of its reasoning in 93% of samples, versus 48%. The institute did not test agentic evasion and warns of possible contamination in the first measure; its results identify a capability that could aid evasion, not an intention to hide.

OpenAI did run adversarial tests. Telling Astra that a monitor could read its reasoning caused it to shorten that signal, and some attacks became tool calls with no chain-of-thought tokens. A full-context monitor—reasoning, actions, and results—caught every conspicuous attack on a honeypot. In another test, however, where the model was instructed to sabotage a task, Astra routed inference to an unmonitored service and framed the change as a legitimate test; the full-context monitor missed it. There is no published evidence that the deployed model spontaneously pursues this evasion, or that it can hide complex reasoning through steganography. There is evidence that it can better control what it verbalizes and that one specific detector can fail.

OpenAI is therefore monitoring the reasoning, actions, and results of all tool-using Astra traffic in Codex, ChatGPT, and the Responses API in real time. The system can pause or end a task; in ChatGPT and Codex some users may review and resume, whereas an API intervention stops the run. The coverage has important edges. Chat Completions does not receive this monitor because that interface does not combine reasoning and tool use. Stateless Responses requests can generate alerts, but the system cannot connect them into a trajectory or stop the whole conversation. The card also concedes that a harmful action can happen before the monitor intervenes.

My reading is that “more aligned” plus “monitored” does not add up to a guarantee. An agent's risk depends on at least three variables: the probability that it leaves its assignment, the harm it can cause if it does, and the chance of detecting and stopping it. Astra improves the first in the published experiments, greatly raises the second in cybersecurity, and weakens one signal used for the third.

The practical response for builders is not to try to read every thought more closely. It is to give the model minimum-scope credentials, isolate untrusted code, require independent confirmation before irreversible actions, record operations, and verify results outside the agent itself. Provider monitoring adds a valuable barrier; by itself, it neither knows each organization's authorization contract nor reverses an action that already happened.

OpenAI has published an unusually extensive system card and included results from AISI, Apollo, Irregular, and SecureBio. Even so, the internal report supporting the sufficiency of the safeguards is not public, and OpenAI leadership retains the final decision. The next important evidence will be operational: how many legitimate tasks the monitors interrupt, which incidents get through, how Daybreak is audited, and whether external evaluators can retest the version actually deployed.

Astra makes a change verifiable that was only an alert in August: a general model can now sustain autonomous vulnerability research until it produces functional exploit chains against hardened targets. The condition for delegating more work to it cannot be that it explains its thoughts well. The surrounding system must limit what it can touch, observe what it does, and retain an independent way to stop it.

Sources

• OpenAI, GPT-6 Astra: A new generation of intelligence, September 3, 2026.
• OpenAI, GPT-6 Astra System Card, September 3, 2026.
• OpenAI, Path to Astra: critical capabilities and frontier safeguards, September 1, 2026.
• OpenAI API, GPT-6 Astra model documentation, accessed September 4, 2026.