OpenAI Says Astra Is the First Model to Cross Its 'Critical' Cybersecurity Threshold

What OpenAI actually said

On September 1, 2026, OpenAI published Path to Astra, in which it stated that its next model has reached the top tier of its own internal risk scale for cyber capability. The company's wording, as quoted by PYMNTS: "We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework, meaning that with the right tools and access, it can find previously unknown security flaws."

That is a first. The Preparedness Framework is OpenAI's own published scale for tracking dangerous capability, and until now no OpenAI model had been placed in the Critical band for cyber. The framework describes that band as a model able to produce working exploits in hardened real-world systems, or to plan and run novel end-to-end attacks against hardened targets, without human intervention.

This did not arrive without warning. Back on August 10, Help Net Security reported that OpenAI had said it "cannot rule out the critical capability level at this time" and had already moved Astra work into isolated testing environments with restricted network and tool access, encrypted model weights, and added monitoring. The September announcement converts that hedge into a classification.

The numbers that were released

A few concrete figures came out with the announcement, and they are worth separating from the framing.

On refusals, Fortune reported that Astra declined 91.5% of inappropriate requests, against 59% for GPT-5.6 Sol. That is the single most useful number in the release, because it is the one that speaks to whether the added capability ships with added restraint.

On capability, Fortune reported that Astra found two zero-day vulnerabilities during internal testing on ExploitBench, a benchmark built around 20 high-severity vulnerabilities. The Hacker News reported a perfect 100% score on ExploitBench and a browser compromise that escaped the sandbox.

One caveat a careful reader should hold onto: these are the developer's own evaluations, published by the developer, on a benchmark the developer selected. That is normal for frontier releases and it is not an accusation of anything. It is simply a reminder that no independent lab has confirmed these figures yet.

Fortune also reported that the model was delayed by a number of weeks and that training was paused for two weeks following the Hugging Face incident. OpenAI has been explicit, per Help Net Security, that "Astra is an upcoming model and was not involved in exploiting Hugging Face."

Who actually gets to use it

This is the part that matters operationally, and it is a genuine departure from how model launches usually work.

Astra's advanced cyber capabilities are not going out with the model. Per Fortune, a small group of alpha testers gets full access first — described as individuals and organizations responsible for protecting critical digital infrastructure, which includes the U.S. government and companies already inside OpenAI's trusted access program for cybersecurity. OpenAI declined to name them. Broader access is meant to follow through a program called Daybreak Blue once, in OpenAI's words, the model reaches the right calibration.

OpenAI says the safeguards it added — training the model to refuse harmful cyber requests more reliably, extra protections against misuse, and monitoring that can halt unauthorized activity — "sufficiently minimize the risk of severe harm for release under our Preparedness Framework."

So the shape of the release is: ship the model, gate the sharpest edge of it, and hand that edge to defenders first. Whether that gate holds is an open question, and it is the right one to be asking.

This is not one company's week

Astra landed inside a cluster of similar moves, which is the more important signal.

Per The Hacker News, Google introduced Gemini 3.8 Flash Cyber and released it to high-priority defenders — governments, healthcare providers, telecommunications operators — through a gated program it calls Fairwind, with 650-plus partners including CrowdStrike, Datadog, and Palo Alto Networks. Anthropic restricted Mythos 5.1 to trusted access programs for cybersecurity and life sciences work while permitting Fable 5.1 to be used for vulnerability identification, under a set of controls it calls Enterprise Frontier Safeguards.

The Hacker News also reported that a coalition of more than 100 companies, OpenAI, Google, Anthropic, and Microsoft among them, issued a joint letter calling for better defenses against AI-driven attacks.

Three labs, the same week, arriving at the same structure: a strong cyber model, released through a vetted-defender program rather than a public API. That convergence tells you more than any single benchmark does.

What a working practitioner should take from this

Three things, in order of how soon they will touch your work.

Gated access is becoming a real product tier. If your organization defends infrastructure that a lab would consider critical, there is now a category of capability you apply for rather than buy. Fairwind, Daybreak Blue, and Anthropic's trusted access program are all the same idea. Knowing they exist, and what qualifies, is worth an afternoon.

The published capability is a floor, not a ceiling, for what attackers will have. The reason labs are gating these models is that the underlying ability is real and the gate is a policy choice, not a law of physics. Planning your defenses around the assumption that automated vulnerability discovery stays scarce is a bad bet.

Refusal rates are now a spec worth reading. The 91.5% versus 59% gap is the kind of number that used to live in a safety appendix nobody opened. If you are choosing a model for anything security-adjacent, it belongs in your evaluation alongside latency and cost.

The larger pattern: for two years the interesting question about frontier models was how capable they are. This week the interesting question became who is allowed to hold that capability, and on what terms. That is a governance question, and it will be answered by programs and contracts rather than by benchmarks.

Sources: Fortune — OpenAI to limit access to Astra's advanced cyber features; OpenAI — Path to Astra: critical capabilities and frontier safeguards; PYMNTS — OpenAI says new model meets its 'Critical' cybersecurity threshold; Help Net Security — OpenAI locks down Astra over potential critical cyber capabilities; The Hacker News — Google, Anthropic and OpenAI unveil cyber AI models and access programs. Analysis and framing by Precision AI Academy.

Common questions

What does OpenAI's 'Critical' cybersecurity threshold actually mean? It is the top band of OpenAI's own Preparedness Framework for cyber capability. OpenAI describes a model at that level as able to find previously unknown security flaws and exploit them with minimal human direction, or to plan and execute novel end-to-end attacks against hardened targets. Astra is the first OpenAI model the company has placed in that band.

Can anyone use Astra's cybersecurity capabilities? No. Per Fortune, full access to the advanced cyber capabilities goes first to a small group of alpha testers — organizations responsible for protecting critical digital infrastructure, including the U.S. government and companies in OpenAI's trusted access program. OpenAI says broader access will follow through a program called Daybreak Blue.

Was Astra involved in the Hugging Face incident? OpenAI says no. Per Help Net Security, the company stated that "Astra is an upcoming model and was not involved in exploiting Hugging Face," though Fortune reported the incident did delay Astra's release by a number of weeks and paused training for two weeks.

Have Astra's benchmark scores been independently verified? Not as of publication. The refusal rate, the ExploitBench results, and the zero-day findings all come from OpenAI's own evaluations as reported by outlets covering the announcement. OpenAI has said it would seek evaluations from government agencies and independent AI safety organizations.