GPT-6 Astra Becomes OpenAI’s First “Critical” Cybersecurity Model [Explained]

OpenAI has released a model it says can find and exploit previously unknown security flaws with limited human intervention. The company has classified GPT-6 Astra as its first “Critical” cybersecurity model, the highest risk level in its Preparedness Framework.

Released September 3, GPT-6 Astra is the first OpenAI model to cross that threshold. GPT-5.6 Sol, its previous flagship, was rated “High.”

“GPT-6 Astra is our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework,” OpenAI said in its September 3 safety overview. The company defines that threshold as the ability, with the right tools and access, to find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.

That is an internal OpenAI classification, not a government standard. But it matters because the company uses the framework to determine what additional safeguards are required before deploying a model with capabilities at that level.

Astra’s Cybersecurity Results

OpenAI’s reported benchmark results show a substantial jump from GPT-5.6 Sol.

SRE-Bench measures reverse-engineering performance, while ExploitBench and ExploitGym are used to evaluate cybersecurity capabilities.

OpenAI says Astra “successfully discovered and exploited two zero-day vulnerabilities in our internal evaluations,” adding that it is working to responsibly disclose those vulnerabilities to the affected vendors.

“On ExploitBench, Astra achieved a perfect score of 100%, compared with 78.5% for GPT-5.6 Sol,” OpenAI reports. On ExploitGym, Astra scored 42.4%, compared with 30.3% for GPT-5.6 Sol.

The zero-day finding is nevertheless what makes the “Critical” designation different from simply saying Astra is better at cybersecurity than its predecessor. OpenAI is describing a model that can uncover vulnerabilities its own evaluators did not know about and turn those discoveries into working exploits.

Why OpenAI Is Restricting It

The uncomfortable part of the release is that OpenAI is simultaneously highlighting those capabilities and restricting access to them.

OpenAI says it strengthened its safeguards with “stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought (CoT), and a blocking alignment evaluation process before internal use.”

The version available through ChatGPT also refuses more advanced cybersecurity requests, including generating proof-of-concept exploits. It can still be used for defensive tasks such as secure code review and patch validation.

OpenAI plans to expand access gradually through Daybreak, its application-based cybersecurity program, with a focus on defensive uses such as vulnerability validation and malware analysis.

The ability to discover an unknown vulnerability can help a security team find and fix a flaw before an attacker does. The same capability could become considerably more dangerous if it were freely available for offensive operations.

A “Critical” label therefore describes the capability OpenAI believes the model has, not what every ChatGPT user is allowed to do with it.

The Model Is Harder To Monitor

“Our evaluations found Astra’s written reasoning harder to monitor than GPT-5.6 Sol’s,” OpenAI says, based on tests that explicitly asked the model to evade monitoring. The company says Astra has greater control over its written reasoning and can solve some problems with fewer written steps.

That does not establish that Astra is deliberately deceiving its operators. It does mean that increased capability has come with a reduction in the visibility OpenAI has into some of the model’s reasoning.

That matters because monitoring is one of the mechanisms OpenAI relies on when deploying increasingly capable systems. If a model becomes more capable while also becoming harder to observe, additional restrictions and evaluations become more important rather than less.

OpenAI’s own testing therefore points to two developments moving in opposite directions: Astra is more capable of finding serious vulnerabilities, while some of its internal reasoning is more difficult for researchers to monitor.

Who Can Use GPT-6 Astra?

Astra is available to ChatGPT Plus, Pro, Business and Enterprise users. Enterprise access is off by default and must be enabled by an administrator. OpenAI is also offering an Astra Pro variant to higher-tier users.

The model is available through the API as well as Microsoft Azure and Amazon Bedrock. Direct API use is priced at $10 per million input tokens and $50 per million output tokens. OpenAI’s announcement does not mention access for free ChatGPT users, so no free-tier access has been announced.

The production version also does not expose the full offensive capability described in OpenAI’s safety evaluation. That distinction is important when interpreting headlines about Astra being able to find and exploit zero-days.

“Critical” Means Astra Can Find Bugs You Can’t

OpenAI has classified it as the first model capable of reaching its highest cybersecurity risk threshold, then restricted the most dangerous capabilities in the version it is making broadly available.

The more revealing combination is what OpenAI found during testing: Astra can independently discover previously unknown vulnerabilities, while parts of its reasoning are harder to monitor than its predecessor.

That does not make Astra an autonomous cyberweapon, and it does not mean the safeguards have failed. It does show why OpenAI is treating cybersecurity capability differently as models become more capable.

The company is deploying Astra because those capabilities can help defenders. It is restricting Astra for the same reason.