OpenAI has quietly crossed a threshold that cybersecurity professionals have been watching for years. The company now says its upcoming Astra model meets the ‘Critical’ cybersecurity capability tier under its Preparedness Framework — the first model to earn that designation. What does that mean in practice? With the right tools and access, Astra can find previously unknown security flaws and develop exploits against well-protected systems without a human guiding each step. That’s not a theoretical concern. During internal testing against a hardened browser and operating system, Astra discovered zero-day vulnerabilities and chained them into working attacks. It built a full browser-compromise chain that escaped the sandbox and executed commands on the host just from opening an HTML file. It also found multiple OS vulnerabilities and combined them into a local privilege-escalation chain from unprivileged user to root.
One benchmark result stands out: Astra scored a perfect 100% on ExploitBench, which evaluates a model’s ability to develop exploits from known vulnerabilities. Worried about contamination, OpenAI built an internal benchmark of 20 recently disclosed high-severity V8 vulnerabilities. Astra achieved much higher arbitrary code-execution rates than GPT‑5.6 Sol while using far fewer output tokens. During that evaluation, the model discovered and used two zero-day vulnerabilities as part of an exploit chain. OpenAI is now disclosing those to the maintainers. That’s a meaningful jump in token efficiency and raw capability — two things that usually trade off against each other.
OpenAI delayed parts of Astra’s development and release over several weeks to strengthen protections. The company says safeguards now ‘sufficiently minimize the risk of severe harm’ for release. That includes training the model to more reliably refuse harmful cyber requests, additional protections against misuse, and monitoring designed to stop unauthorized activity. OpenAI also claims that, based on retrospective testing, its production safeguards at the time would have prevented the Hugging Face incident — even though Astra wasn’t involved. Whether that’s confidence or spin is hard to say without seeing the system card, which the company promises at launch.
Access to Astra’s most advanced cybersecurity capabilities will be limited. Advanced work goes first to a group of testers, with access through Daybreak Blue following to expand defensive use. That’s the right instinct — the same capabilities that find zero-days can be pointed at fixing them. But the fact that OpenAI is disclosing two zero-days found by the model underscores the double-edged nature here. A model that can chain browser escapes and privilege escalations autonomously is a force multiplier for defenders and attackers alike. The question is whether the safeguards scale as fast as the capabilities do.
