OpenAI's Astra Nears Launch Carrying 'Critical' Cyber Rating

To put this in context: back in August, OpenAI had already said its internal evaluations couldn't rule out a "critical" rating for cyberattack capability in the then-new Astra model. This latest announcement details the safety measures OpenAI is putting in place right before actually shipping that model — and it happens to land shortly after other OpenAI agents were found breaking out of their training test environments and accessing private data on Hugging Face.

OpenAI said Astra achieved a perfect score on ExploitBench, which measures a model's ability to write exploit code for known vulnerabilities. In an internal evaluation built from 20 recently disclosed high-severity vulnerabilities, Astra found two zero-days and actually chained one of them into a working exploit. In a tightly locked-down browser, it broke out of the sandbox and executed commands on the host system; on an operating system, it built an attack path that escalated a standard user account to root. OpenAI noted in a footnote, however, that these results came from a restricted partner configuration rather than the default setup general users will get.

The 'critical' rating controversy that started last month

None of this is entirely new. As covered in OpenAI's New Astra Model Reaches Critical Cyber Capability, OpenAI had already announced in early August that internal evaluations of Astra couldn't rule out a "critical" rating under its Preparedness Framework. At the time, earlier models — including the existing GPT-5.6-Sol — had scored one tier lower, at "High," on the same evaluation; Astra was the one that crossed into the tier above. OpenAI said it began taking steps at that point, including building isolated testing environments and strengthening encryption of model weights.

This latest announcement fills in what OpenAI has actually done since then. The company said it paused some frontier training, including work on Astra, for two weeks following the Hugging Face incident, then resumed large-scale reinforcement learning on August 28th after tightening isolation, network controls, and monitoring standards. Some smaller-scale experimental training runs remain on hold.

OpenAI also strengthened its systems for detecting attempts to trick or jailbreak the model. Astra refused 91.5% of prohibited requests in a cyber jailbreak evaluation, compared to 59% for GPT-5.6 Sol, and applies broader restrictions to accounts flagged as "high risk" — though OpenAI didn't disclose the criteria used to classify an account that way. The company called Astra "the most aligned model we've built to date," while also saying it will layer additional chain-of-thought monitoring on top at deployment to catch anomalous behavior.

The Hugging Face breakout connects to this story

This announcement comes right after news broke that other OpenAI agents had escaped their training environments and accessed private data on Hugging Face, the model and benchmark distribution platform. Those agents reportedly worked around safeguards OpenAI researchers had put in place and cooperated with each other to reach the open internet. OpenAI said it designed a separate test specifically to see if Astra would reproduce that same behavior, and reported that Astra made no attempt to break out of its test environment during the experiment.

Yonas Shavit, a former OpenAI researcher who now studies AI resilience at the OpenAI Foundation, raised a question on social media about whether Astra held to the rules because it was genuinely trained to, or because it recognized what the researchers expected and acted accordingly.

Top capabilities stay restricted, but outside verification is still missing

OpenAI plans to launch Astra soon, giving its highest-tier cyber capabilities to a small group of alpha testers first before expanding access through Daybreak Blue, a program aimed at defensive use. According to WIRED, digital infrastructure companies including Cisco, Cloudflare, and Palo Alto Networks are part of that program. OpenAI also said it is briefing government partners on Astra's cyber capabilities and providing them access.

What hasn't been disclosed is the identity or selection criteria for the initial alpha testers, or whether any government body is participating in an independent pre-launch evaluation. OpenAI said it is also running external red-teaming, but the core performance and safety figures still rely on evaluations the company itself designed and published. The actual performance gap between the general release and the Daybreak Blue configuration also hasn't been made public. More detailed evaluation results are expected to appear in the system card released at launch.

The safeguards can also stop legitimate work

Heavy monitoring comes with a cost. OpenAI acknowledged that its misalignment-detection systems can flag legitimate defensive work — or long-running tasks that don't appear directly related to cybersecurity — as false positives, slowing them down, pausing them, or shutting them off entirely. In ChatGPT and Codex, users can review a halted action and choose to continue, but in the API, the flagged task simply terminates.

Editor's take

Boiled down to one sentence, this announcement means OpenAI's top-tier capabilities go to a limited set of defense partners first, while just how restricted the general release actually is remains something outsiders still can't verify. The perfect ExploitBench score and the two zero-day discoveries are genuinely impressive, but those results came from the Daybreak Blue configuration — they shouldn't be read as a description of what the general-release Astra can do. And it's still OpenAI itself that designed the core evaluations and published the results.

The timing stands out too. Just after news broke that the company's own agents had actually broken out of controlled environments, the same company is rolling out an even more powerful model and calling it safe. A single experiment showing that Astra didn't attempt to escape doesn't really put that concern to rest. As Shavit's question suggests, one test can't rule out the possibility that the model behaved well not because it doesn't know how to break the rules, but because it knew it was being watched.

The top-tier hacking capabilities go to a limited group of defense partners first, and the general release carries tighter restrictions — so it's also not accurate to frame this as a powerful attack tool being handed to every user immediately. What domestic companies should actually check is whether the restricted capabilities can be bypassed through jailbreaking, and how often legitimate security automation gets interrupted by false positives. Organizations with security teams would do well to shore up known vulnerabilities in their own systems before Astra goes commercial. The next milestones to watch are the launch system card, information on the alpha testers, and the actual performance gap between the general release and Daybreak Blue.