OpenAI rates Astra at Critical cybersecurity level; release set with restricted capabilities

Astra classified at the Critical cybersecurity threshold under OpenAI's Preparedness Framework

OpenAI announced on 2 September 2026 that its Astra model has reached the Critical cybersecurity capability level, the first model to do so under the company's Preparedness Framework. In testing, Astra identified and used two zero-day vulnerabilities among a set of 20 high-severity flaws tested, and outperformed the prior system, GPT-5.6 Sol, on exploit tasks. The Critical rating is a vendor-defined threshold inside OpenAI's safety governance, and practitioners should treat it as a signal that the model's offensive capabilities have crossed an internal line requiring additional controls before broad access.

Release planned "soon," but advanced cybersecurity functions gated to a limited tester group

OpenAI stated it plans to release Astra soon while limiting the model's strongest cybersecurity features to a select set of testers, following several weeks of additional safety and security work. One outlet reported that the company has not published a specific public release date, and a separate outlet said the rollout comes less than two weeks after a prior announcement, though the underlying message is the same: full offensive capability will not be available at general availability. For teams building on OpenAI's APIs, the practical takeaway is that any tooling assuming unrestricted cybersecurity automation must wait for the controlled-access pathway or plan to operate without it.

A broader pattern of autonomous vulnerability discovery in frontier models

The Astra classification fits a wider pattern of AI systems being credited with discovering or exploiting zero-day flaws without human guidance. Coverage of Astra noted it can autonomously find and use unknown vulnerabilities, framing the Critical rating as a milestone in machine-driven offensive security. For encoding and security practitioners, the implication is straightforward: defensive workflows that assume human-only authorship of exploits are now out of date, and hardening of certificate, hashing, and authentication pipelines needs to assume that adversarial probes can be generated at model speed.

What to watch next: gated access, rival frameworks, and a still-unspecified public release date

Two near-term items deserve a calendar reminder. First, OpenAI has named no specific public release date for Astra, and several outlets flagged tighter controls as a condition of release; practitioners building on the model should track the controlled-access tester program rather than the general release. Second, the reporting ecosystem around Astra's classification has begun comparing OpenAI's Preparedness Framework against rival frameworks, a comparison that will sharpen once a public release date and the gating criteria for testers are published.

Until then, the concrete facts to act on are the Critical rating itself, the model's demonstrated ability to find and exploit zero-days, and the fact that the most advanced cybersecurity functions will not be open by default.