- OpenAI said on August 7 that recent internal evaluations of Astra, an upcoming model, mean it cannot rule out that the model has reached the Critical cybersecurity threshold under its Preparedness Framework, the first OpenAI model to reach that bar.
- The Critical level covers a model that can find and build working zero-day exploits across many hardened real-world systems without human help, or run end-to-end cyberattacks against hardened targets from a single high-level goal.
- OpenAI is pausing internal Astra work that does not meet strengthened controls, adding isolated testing, encrypted weight protection, and universal chain-of-thought monitoring, and will bring in government agencies and safety organizations to test the model.
OpenAI cannot rule out Critical cyber capability in Astra
OpenAI made an unusual disclosure this week about a model it has not shipped. In a security note published on August 7, the company said evaluations of Astra over the prior few days, combined with expert assessments, led it to conclude the night before that it could no longer rule out Critical cyber capabilities under its Preparedness Framework. Every prior OpenAI model, including GPT-5.6-Sol, had topped out at the High threshold, according to Quartz. Astra is the first to cross into the tier above.
The distinction is not rhetorical. Under the framework, a model sits at Critical if it can identify and develop functional zero-day exploits of all severity levels across many hardened real-world critical systems without human intervention, or devise and execute novel end-to-end cyberattacks against hardened targets given only a high-level goal. OpenAI said its preliminary results were strong enough that it could not confidently place Astra below that line while testing continues.
"Our latest internal evaluations of Astra, one of our upcoming models, over the past few days indicate significant advancements in agentic coding and cybersecurity. These results, in addition to expert assessments, have led us to conclude last night that we cannot rule out critical cyber capabilities under our Preparedness Framework."OpenAI, security disclosure, August 7, 2026
Why a model on hold matters more than one on sale
OpenAI's response is the story as much as the capability is. The company said it is pausing internal Astra activities that do not yet meet strengthened security requirements, and is layering in isolated testing environments, restricted network and tool access, enhanced weight encryption, sandboxed execution, and universal monitoring that reads the model's chain of thought and interrupts high-risk activity. It also committed to testing the model with government agencies and select safety organizations before wider use.
| Preparedness tier Astra may have reached, a first for OpenAI | Critical |
| Ceiling for every prior model, including GPT-5.6-Sol | High |
| When the Preparedness Framework was first published | Dec 2023 |
The framework was written in December 2023 precisely so the company would have a rule in place before a model reached this point. This is the first time OpenAI has invoked it to hold back its own work on cyber grounds, and it did so on a model that is not yet a product. OpenAI also noted that Astra was not the model involved in the earlier red-team breach of Hugging Face, keeping this separate from that incident.
Naming a capability the company cannot yet contain, and slowing its own roadmap to build the containment, is a more revealing signal than any benchmark score. Astra is not a warning about what attackers might eventually do with open models. It is OpenAI conceding that its own next system can now do the thing the industry has spent two years insisting was still years away, and choosing to keep it in a locked room until the safeguards catch up.
Santage is committed to independent, transparent journalism. This article is produced in accordance with Santage's Editorial Standards and aims to provide accurate and timely information. Readers are encouraged to verify information independently.