GPT-6 Astra is the first model OpenAI has classified at the Critical level for cybersecurity capability under its Preparedness Framework, per OpenAI. Critical in that framework means the ability to find and exploit novel vulnerabilities in hardened targets without step-by-step human guidance. Tested without production safeguards, Astra scored 100% on ExploitBench, which measures turning known vulnerabilities into working exploits, against 78.5% for GPT-5.6 Sol. On ExploitGym it reached 42.4% against Sol's 30.3%, per The Hacker News.
The disclosure covers what OpenAI decided and what it restricted. It found the capability had crossed the threshold it had worried about since August, and it shipped under limits. The released model is scoped to secure code review and patching and refuses requests to build proof-of-concept exploits. It also carries hardened jailbreak resistance, expanded monitoring, and additional misalignment detection. Enterprise administrators must turn Astra on manually. Access is off by default.
OpenAI also committed $1 billion to a program called Daybreak for Frontline Defenders, subsidizing access for critical-infrastructure operators with guided training, piloted with the US Multi-State Information Sharing and Analysis Center. Once a capability at this tier exists, any defender advantage has to come from distribution and price, since attackers can reach a frontier system or wait for an open-weight equivalent.
OpenAI states the main caveat itself: safety checks can interrupt legitimate work, including defensive cybersecurity, and require a human to review before continuing. That puts the control in tension with the use case. The refusal layer that makes a Critical-rated model shippable also slows the defensive workflows Daybreak subsidizes. Refusals are policy, and the model scored 100% when that policy was removed for testing.
Bottom Line
OpenAI is the first lab to ship a model it publicly rates Critical for cyber capability, and the safeguards are refusals and monitoring with the capability intact. Test how often the refusal layer blocks your own defensive work before you route incident response through it.