OpenAI: Astra cannot rule out critical cyber risk

OpenAI's announcement marks a notable shift in its capability assessments, as it is the first time the company says it cannot rule out Critical cyber capabilities for a model. The Preparedness Framework, first published in December 2023, was designed to guide the company's actions as models approach biological, chemical, cybersecurity, and AI self-improvement capabilities. Previous models, including GPT-5.6-Sol, were evaluated at the High threshold for frontier cyber capabilities.

The company is applying the same principle it used in June 2025 when models approached the high capability threshold for biology, outlining steps to strengthen safeguards and expand testing. Now, OpenAI is implementing stricter controls, pausing some Astra activities, and adding universal monitoring. The framework has already guided the company through other capability transitions.

The stakes hinge on whether further testing, in partnership with government agencies and AI safety organizations, will confirm the Critical assessment. If confirmed, it would represent a significant advancement in what AI models can do in cybersecurity, potentially outpacing current safeguards. The company's ability to balance transparency with secure development will be tested as it navigates this potential shift.