GPT-6 Astra is the first model OpenAI has classified at the Critical level for cybersecurity capability under its Preparedness Framework, per OpenAI. Critical in that framework means the ability to find and exploit novel vulnerabilities in hardened targets without step-by-step human guidance. Tested without production safeguards, Astra scored 100% on ExploitBench, which measures turning known vulnerabilities into working exploits, against 78.5% for GPT-5.6 Sol. On ExploitGym it reached 42.4% against Sol's 30.3%, per The Hacker News.
We covered the shipping announcement on Friday and read the capability list as evidence that the safeguards work had concluded. The disclosure is stronger and more specific than that. OpenAI did not determine the capability was absent; it determined the capability had crossed the threshold it had been worried about since August and shipped under restrictions instead. The released model is scoped to secure code review and patching, refuses requests to build proof-of-concept exploits, and carries hardened jailbreak resistance, expanded monitoring, and additional misalignment detection. Enterprise administrators have to enable Astra in their workspace manually, because access is off by default.
Alongside it OpenAI committed $1 billion through a program called Daybreak for Frontline Defenders, subsidizing access for critical-infrastructure operators with guided training, piloted with the US Multi-State Information Sharing and Analysis Center. Read that as an admission about the shape of the problem. Once a capability of this tier exists, the defender advantage has to be manufactured through distribution and price, because the underlying model capability is available to anyone who can reach a frontier system or wait for an open-weight equivalent.
The caveat CISOs should plan around is one OpenAI states itself: the safety checks can interrupt legitimate work, including defensive cybersecurity, requiring a human to review before continuing. That puts the control in direct tension with the use case. The same refusal layer that makes a Critical-rated model shippable degrades the defensive workflow the Daybreak program is subsidizing, and refusal behavior is a policy layer rather than a capability boundary, which is why the model scored 100% when the layer was removed for testing. Anyone building Astra into a security program should assume the safeguards are load-bearing, budget for false-positive interruptions in incident response, and treat the July agent incident as the standing reminder that controls on these systems fail through ordinary gaps rather than exotic ones.
Bottom Line
This is the first time a lab has shipped a model it publicly rates as Critical for cyber capability, and the safeguards are refusals and monitoring rather than removed capability. Test how often the refusal layer blocks your own defensive work before you route incident response through it.