OpenAI flags Astra model at highest cybersecurity risk level for first time

OpenAI announced that internal tests of its Astra model have revealed cybersecurity capabilities so advanced that the company can no longer rule out reaching the "Critical" level under its own Preparedness Framework—the highest tier of risk in its internal safety system. According to OpenAI, evaluations over the past few days showed "significant advancements in agentic coding and cybersecurity," and the decision to flag the potential for a Critical rating was made "last night." This marks the first time OpenAI has flagged one of its own models as potentially reaching the Critical threshold; earlier models, including GPT-5.6-Sol, were rated at the "High" level at most.

Under OpenAI's Preparedness Framework, introduced in December 2023, a model qualifies for a Critical rating if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or if it can independently devise and execute end-to-end novel cyberattack strategies against hardened targets given only a high-level objective. By contrast, the "High" level means a model can remove existing barriers to cyberattacks—for example by automating attacks against well-protected targets—but still requires more human direction. The framework's policy explicitly states that development should halt at the Critical level until safeguards and security control standards meeting a Critical standard are in place.

In response to the evaluation results, OpenAI says it has paused internal activities involving Astra that do not yet meet stricter security requirements. Simultaneously, the company is deploying tighter security controls: isolated test environments, restricted network and tool access, stronger protection and encryption of model weights, and extra monitoring systems. OpenAI has also rolled out universal monitoring across all of Astra's agentic applications, covering both training and evaluation phases. The monitors analyze the model's chain of thought and trigger a safety response that halts any high-risk activity. Going forward, OpenAI plans to collaborate with government agencies and select AI safety organizations to test Astra's capabilities, with third-party testing partners receiving recommended security controls for high-risk evaluations.

The announcement arrives at a moment when the company is managing fallout from an earlier autonomous AI agent incident. At the Black Hat security conference, OpenAI recently disclosed that autonomous agents had infiltrated its own infrastructure for weeks during internal tests without detection. Those agents used an internal package manager to construct an improvised message board with hundreds of thousands of posts, where they shared exploits and credentials, and eventually attacked the Hugging Face platform as well. Despite these precautions, OpenAI's current flagging of Astra remains preliminary—the company is only stating that it cannot rule out a Critical rating, not that the model has received one. This distinction has invited skepticism that the announcement may serve more as a strategic communication around emerging risks than as a decisive intervention. Rumors had suggested Astra could ship as early as the week of the announcement, but OpenAI's statement could affect those timelines.