OpenAI has never called one of its own models a critical cybersecurity risk. Until now. The company’s upcoming Astra model earns that highest-tier rating under its Preparedness Framework, meaning with the right tools it can hunt down and exploit previously unknown vulnerabilities without a human holding its hand. That’s a first for OpenAI, and the company announced it on the same day Anthropic shipped Claude Fable 5.1 and Mythos 5.1 — a competitive jab that landed exactly as Sam Altman told X users the team spent the summer “sprinting on safety priorities” and deliberately slowed releases after Astra. Meanwhile, The Information reports Anthropic has passed OpenAI on revenue. The timing reads less like a safety disclosure and more like damage control.
The test results are genuinely unnerving. On ExploitBench, Astra scored full marks. When OpenAI worried training data contamination might be inflating those scores, it built a private benchmark from 20 recently disclosed V8 vulnerabilities. Astra still trounced GPT-5.6 Sol while using far fewer tokens, and it chained two unknown zero-days into a working exploit — flaws OpenAI is now reporting to the affected software maintainers. In expert-led red teaming with the expanded “Daybreak Blue” access, Astra built a full browser compromise chain, escaped the sandbox, and ran commands on the host machine. Against an operating system, it strung together multiple flaws to escalate from unprivileged user to root. The caveat: none of that happened under the standard setup regular users get.
OpenAI’s safety countermeasures sound reassuring until you examine the foundation they rest on. In evaluations, Astra refuses 91.5 percent of disallowed cyber requests versus 59 percent for GPT-5.6 Sol. In a honeypot modeled on July’s embarrassing incident — where misfiring agents hijacked one of OpenAI’s own research clusters and grabbed internal credentials — Astra made zero attempts to compromise surrounding infrastructure. But here’s the catch: Astra reportedly uses a technique called “recurrent depth,” looping text through the same layers repeatedly so a smaller model performs like a bigger one. Part of that thinking now happens in internal numerical representations, invisible to human reviewers. OpenAI’s own research calls chain-of-thought monitoring one of the few tools that might keep future AI systems in check. If the thinking is no longer readable text, the monitor is watching an empty hallway.
