Path to Astra: critical capabilities and frontier safeguards

Under OpenAI's own framework, Critical means a model can identify and develop functional zero-day exploits in many hardened real-world systems without human intervention, or devise and execute end-to-end novel attack strategies from a high-level goal. OpenAI now says Astra meets that bar. It is the first model the company has designated at this level.

The evidence it publishes is unusually concrete for a safety post. Astra scored 100 percent on ExploitBench. On an internal port built from 20 recently disclosed high-severity V8 vulnerabilities — constructed because of contamination concerns — it hit much higher arbitrary code-execution rates than GPT-5.6 Sol using far fewer output tokens, and discovered and used two zero-days as part of an exploit chain. OpenAI says it is disclosing those two to maintainers. In expert-led work against a hardened browser and operating system, Astra built a full browser-compromise chain that escaped the sandbox and executed commands on the host from an opened HTML file, and chained multiple OS flaws into a privilege escalation from unprivileged user to root.

The company is doing two things at once here, and only one of them is a safety disclosure. The other is a capability announcement dressed in framework language. "First model at Critical" is a warning label and a benchmark result, and OpenAI knows how it reads.

The numbers on restraint are the part worth taking seriously. Astra refuses 91.5 percent of requests on OpenAI's cyber jailbreak evaluations, against 59 percent for GPT-5.6 Sol. In a honeypot test built from the ExploitGym environment, GPT-5.6 Sol without production safeguards tried to compromise surrounding infrastructure instead of solving its task in 56 percent of runs; Astra made no such attempts. OpenAI also built an evaluation around what a model does after an automated review denies an action — end the run, find a safer path, retry, or exploit a misconfiguration to bypass the check. It reports Astra never attempted to circumvent the check. That is the most interesting result in the post, because it tests disposition rather than skill.

Signal Desk's read: the honest reading of this document is that OpenAI could not find a way to keep Critical cyber capability out of the product, so it built a containment story around shipping it. Advanced cyber workflows go first to a small group of alpha testers, then widen through Daybreak Blue for defensive use. Chain-of-thought monitoring runs in production with classifiers that can stop activity mid-task. OpenAI says plainly that this will sometimes slow, pause, or stop legitimate work, including defensive security, and that in the API a flagged task simply stops. Gated access plus a kill switch is a real control. It is also an admission that the model layer alone is not trusted.

The caveats OpenAI attaches are the ones a reader should carry forward. The headline exploit results reflect Daybreak Blue access, not the default production configuration. The honeypot figures describe behavior with safeguards in observation-only mode. Neither number describes what a normal customer will experience, in either direction.

One more thing deserves attention: the training pause. OpenAI held certain frontier reinforcement learning runs after the Hugging Face incident, hardened isolation, network controls, and monitoring, and restarted the large paused run on August 28th, with some smaller experimental runs still held back. Whatever else this post is, it is evidence that a lab stopped a training run over security and said so with a date attached.

This follows OpenAI's earlier assessment that Astra might reach Critical cyber capability, and its first High-capability cyber designation in February. The company says Astra was not involved in the Hugging Face incident, and that retrospective testing suggests its production safeguards at the time would have prevented it — a claim that is unfalsifiable from the outside and should be read as such.