OpenAI's Astra model nears 'critical' cyber threat level, triggering internal lockdown

OpenAI has hit an internal alarm bell. Its upcoming model, Astra, is showing such advanced cybersecurity chops that the company can no longer rule out it has crossed the ‘Critical’ threshold under its own Preparedness Framework. That’s a big deal — it’s the first time a model has been assessed at this level, moving beyond the ‘High’ rating that even GPT‑5.6‑Sol received. The company disclosed the finding late last night, framing it as a transparency move for the safety community.

The Framework defines ‘Critical’ in stark terms: a model that can autonomously find and build working zero-day exploits across hardened systems, or cook up and execute novel end-to-end attack strategies from a simple high-level goal. OpenAI’s preliminary evals suggest Astra’s performance is strong enough that they can’t dismiss that possibility. They were quick to clarify Astra wasn’t the model involved in the recent Hugging Face exploit incident, but the timing still makes the announcement land with extra weight.

In response, the company is slamming the brakes on some internal work. They’re pausing Astra activities that don’t meet newly strengthened security controls — think isolated testing environments, locked-down network access, beefed-up model encryption, and sandboxed execution. They’ve also deployed universal monitoring that watches the model’s Chain of Thought for risky actions and can trigger an automatic security interrupt. It’s a level of internal lockdown that echoes what they did in June 2025 when models approached the high-risk biology threshold.

What’s genuinely new here isn’t just the capability jump — it’s the operational response. OpenAI is now actively building the security architecture for a world where models are offensive cyber tools by default. They’ll be working with government agencies and safety orgs to test Astra, and handing third-party testers a list of recommended security controls. The unspoken tension: a model this capable could be a nightmare in the wrong hands, but it’s also the kind of tool that could let defenders find and patch vulnerabilities before attackers ever see them. The question hanging over all of this is whether the safeguards can evolve as fast as the model did.