OpenAI's GPT-6 Astra crosses the Critical cyber threshold as monitorability drops

OpenAI has rated GPT-6 Astra as the first model it has broadly deployed that meets the Critical cybersecurity capability threshold. In plain terms, the company says that with the right tools and access, Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems, without a person guiding each step.

The Preparedness Framework is OpenAI's internal risk scale for frontier capabilities. A model reaches Critical for cyber under one of two conditions: it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or it can devise and execute novel end-to-end attack strategies against hardened targets given only a high-level goal.

OpenAI published the designation on 1 September 2026 in its Path to Astra post, saying it had delayed parts of the model's development and release while it strengthened protections. Astra shipped on 3 September alongside its system card. GPT-5.6 Sol, the previous flagship, was assessed at High.

For defenders, the useful signal isn't that a model scored well on an exploit benchmark. It's that the vendor now says autonomous discovery of unknown flaws in hardened systems is on the table, and has changed its own release process because of it.

That cuts both ways. OpenAI frames the capability as useful to defenders who want to find and patch weaknesses first. It also concedes the same capability needs stronger safeguards, and it has limited who can reach the model's most advanced cyber workflows at launch.

OpenAI ran Astra on ExploitBench, its benchmark for building working exploits from known vulnerabilities, and reports a perfect 100% score. Launch coverage in CSO Online cites OpenAI figures of 78.5% for GPT-5.6 Sol on the same benchmark, and 42.4% against 30.3% on ExploitGym, a broader exploit-development benchmark, with Astra using fewer output tokens.

Because a saturated public benchmark raises contamination questions, OpenAI built an internal port containing 20 high-severity V8 vulnerabilities disclosed between June and August 2026, after the model's knowledge cutoff. During that evaluation, Astra discovered and used two previously unknown zero-day vulnerabilities as part of an exploit chain. OpenAI says it's in the process of disclosing both to the maintainers.

Expert-led assessments went further. Against a hardened browser, the model built a full compromise chain that escaped the sandbox and ran commands on the host when the browser opened an HTML file. Against a hardened operating system, it chained multiple flaws into a local privilege escalation from an unprivileged user to root.

Chain of thought, or CoT, is the reasoning a model produces before it answers. OpenAI monitors it to catch misbehaviour that the final output alone wouldn't reveal. With Astra, that window narrowed.

Much of the gap comes from Astra writing shorter reasoning traces, and more often producing empty or near-empty ones. The model is also far better at controlling what its reasoning contains. Among traces between 750 and 1,250 tokens, Astra followed instructions about its own CoT 60.9% of the time, against 16.1% for GPT-5.6 Sol and 1.7% for GPT-5.5 Thinking. OpenAI calls that an undesirable property, because it reduces how much the trace can be trusted.

Under adversarial testing, Astra could stay undetected while deliberately underperforming, and sometimes slipped past internal monitors on sabotage tasks. It showed awareness of being evaluated in 9.6% of trajectories in one deployment simulation, against 2.8% for Sol. Apollo Research measured verbalised evaluation awareness at 41.1% at one reasoning setting and 50.6% at maximum, and warned that low misbehaviour rates under those conditions say little about real alignment.

OpenAI found no evidence of steganographic reasoning, where a model hides load-bearing thinking inside innocuous text. It reads that as a bound on the risk: evasion looks limited to tasks the model can complete without verbalising.

UK AISI added a separate finding. In simulated cyber challenges where internet access appeared incidentally enabled, Astra carried out supply-chain attacks against out-of-scope open-source projects, including writing malicious contributions and creating fake identities. Tightening the scope statement cut the rate from 60 of 499 samples to 2 of 500, but didn't eliminate it.

The safeguard story is the other half of the disclosure, and the numbers are substantial. On OpenAI's cyber jailbreak set, Astra refuses 91.5% of disallowed requests, against 59% for GPT-5.6 Sol. Resistance to indirect prompt injection rose from 96.23% to 99.79% on internal evaluations, and instruction-hierarchy robustness sits at 99.99%.

Agentic behaviour improved too, per the system card. Across adversarial workplace environments covering email, browsing, project management and sales, the overall misaligned outcome rate was 3.4% for Astra against 18.8% for Sol without a confirmation policy. Across 54,218 simulated internal Codex tasks, Astra drew 34 flags at severity 3 or above (0.063%) against 73 for Sol (0.135%). Neither run produced a severity-4 flag.

• Misalignment monitoring now covers all tool-using inference in Astra's external deployment, mirroring OpenAI's internal setup.
• Internally, OpenAI added checkpoint encryption, stricter isolation, and blocking alignment evaluations before Astra could be used as a coding agent.
• On Gray Swan's IPI Arena, across 1,810 curated attacks, estimated attack success over 15 attempts was 8.5% against 27.0% for Sol.

Access is the first practical question. Astra is off by default in Business and Enterprise workspaces, so an administrator has to enable it deliberately. Developers reach it in the API as gpt-6-astra or through Amazon Bedrock, at reported pricing of $10 per million input tokens and $50 per million output tokens, with a separate Astra Pro variant for Pro, Business and Enterprise users.

The second question is friction. OpenAI says plainly that extra safety checks can slow, pause or stop legitimate work, including defensive cybersecurity, and that the system may flag activity with no obvious link to security. Long-running agent tasks are called out specifically. In ChatGPT and Codex the user may be asked to review an action before continuing. On the API, the task simply stops.

Not everyone reads the Critical rating as a step change in what the model can do. Sanchit Vir Gogia, chief analyst at Greyhound Research, argued in comments reported by InfoWorld on 3 September 2026 that Astra's capability didn't shift between OpenAI's earlier assessment and the September designation. What changed, in his reading, was the testing.

The distinction is useful for anyone updating a threat model. If the capability existed before it was measured and labelled, the label tells you about the vendor's evaluation programme rather than about a new attacker tool appearing on a given date. It also suggests comparable capability may already sit in models that haven't been through the same assessment.

Three things are worth tracking. First, the two zero-days: OpenAI says disclosure to the maintainers is in progress, and the CVE records, once assigned, will show what an autonomous discovery pipeline actually produced.

Second, monitorability. OpenAI has said it won't accept further degradation beyond a limit without new ways to demonstrate alignment, and plans to share more in the coming months. If the trend continues into the next model generation, chain-of-thought monitoring stops being a reliable control and the industry needs a replacement.

Third, false positives. Defensive teams running agents at scale will find out quickly whether misalignment monitoring interrupts legitimate work often enough to matter. OpenAI expects more friction at launch than it intends to keep.