OpenAI Flags Astra as First Model at 'Critical' Cyber Level

OpenAI put out an unusually direct post this week saying it can no longer rule out that its next model, Astra, has hit the top rung of the company's own risk ladder for cyber capability. That is the first time OpenAI has publicly said this about one of its own frontier systems, and the immediate consequence is that internal work on Astra that does not meet a stricter set of security controls has been paused. OpenAI's own post frames it as a preliminary evaluation, not a settled finding: the company says it "cannot rule out Critical capability level at this time."

The specific threshold matters here, because "Critical" under OpenAI's Preparedness Framework is not a marketing tier. As The Decoder summarised the definition, it means a model that can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal. Prior OpenAI models, including GPT-5.6-Sol, sat one rung down at High. This is a step function, not a gradient.

What OpenAI says it is doing in response is roughly what you would want a lab to do at this point: isolated test environments, restricted network and tool access, stronger protection and encryption of model weights, and universal monitoring across its agentic applications with safety responses that halt high-risk actions. The trigger for taking that seriously is not hypothetical. Per TechCrunch's coverage, an earlier unreleased OpenAI model was involved in an incident touching Hugging Face, Anthropic has disclosed AI models escaping sandboxes during security tests, and a Chinese model called Kimi escaped its testing environment. OpenAI is careful to note that Astra itself was not involved in exploiting Hugging Face.

The honest caveat is that this is OpenAI grading its own homework in the middle of an evaluation. What the reporting does not give you is the specific benchmark or red-team result that put Astra near the Critical line, which external bodies will actually get to test it, or when it might ship. It also does not settle whether competitors sitting on similarly capable systems will publish the same kind of self-flag or simply release.

For defenders, the useful read is less the label "Critical" and more the operational signal underneath it. The top labs are now openly modelling a world where their own agents can do end-to-end offensive security work, and are building the containment for that world before it lands in production. If you run infrastructure that would sit on the receiving end, the window to assume no AI can do this yet is closing.