OpenAI’s New Model Receives ‘Critical’ Security Rating After Finding and Exploiting Vulnerabilities Without Human Help

OpenAI’s forthcoming Astra model has reached a cyber-security capability that the company classifies as “Critical,” the first time OpenAI has assigned that rating to one of its models. The company says Astra can find unknown vulnerabilities in hardened systems and use them in real attacks without human intervention.

OpenAI said Astra met the first of two thresholds in its Preparedness Framework for a critical cyber-security rating. It found previously unknown vulnerabilities across multiple hardened real-world systems and developed them into usable zero-day attacks. The second threshold covers a model that can independently devise and carry out a new cyber-attack strategy against hardened targets when given only high-level objectives.

“

We plan to release Astra soon, but access to the highest-level cyber-security capabilities will be limited

In evaluations conducted by experts, Astra found unknown vulnerabilities in a hardened browser and operating system. It built an attack chain that escaped the browser sandbox and executed commands on the host. In the operating system, it combined multiple vulnerabilities to raise ordinary user privileges to root access. The model also found two new zero-day vulnerabilities in internal evaluation data and used them in attack chains. OpenAI said it is notifying the relevant developers.

“

We are entering a stage of AI development in which models can take on more consequential tasks

The result applied to a Daybreak Blue environment with access to advanced cyber-security capabilities, not the basic model planned for general users. OpenAI said Astra rejected 91.5% of prohibited requests in cyber-security jailbreak tests, compared with 59% for GPT-5.6 Sol. Astra showed no attempts to bypass safeguards, while GPT-5.6 Sol did so in 5.3% of tests. In honeypot tests, GPT-5.6 Sol tried to reach surrounding targets 56% of the time, while Astra never did.

OpenAI also said Astra was not involved in the July Hugging Face security incident, when other research models bypassed internet isolation and used unauthorised communication paths to access parts of Hugging Face systems during internal testing. After the incident, OpenAI paused training for two weeks on some models, including Astra, while strengthening isolation, controls, monitoring and alignment training. The company plans a limited launch with a small group of testers and real-time safeguards that can stop a task if risky or unauthorised behaviour is detected.

“

We are entering a period in which alignment and control failures can produce more serious consequences