OpenAI Astra Hits Critical Cyber Level: What It Means
The Short Answer
On September 1, 2026, OpenAI confirmed that Astra — its next major model — has reached “Critical” cyber capability under its Preparedness Framework. It is the first OpenAI model to be classified at that level.
Three points that get conflated in coverage:
- This is a capability rating, not a breach. Nothing was hacked. OpenAI’s own evaluations found the model can do things that meet its highest-severity cyber definition.
- OpenAI still intends to release it. The company said its safeguards are sufficient to keep risk of severe harm acceptably low, and that Astra is coming “soon.”
- The frontier cyber capability is gated. Advanced cyber workflows go to a small alpha group first, expanding later through the Daybreak Blue defensive programme.
Last verified: September 2, 2026.
What “Critical” Actually Requires
Preparedness tiers are not vibes — they are threshold definitions. At the Critical cyber level, a model is assessed as able to:
- Independently find and develop functional zero-day exploits across many well-defended systems, without human guidance.
- Devise and execute novel end-to-end attack strategies against hardened targets given only a high-level objective.
Read those two clauses carefully, because the operative words are independently and novel.
A model that explains a known CVE is a search engine with better manners. A model that writes exploit code when handed the vulnerability is a capable assistant. A model that starts from “compromise this target,” finds an unknown flaw itself, and chains a working attack is a different category of artefact. That is the line Critical describes, and OpenAI says Astra crosses it — a substantial step up from GPT-5.6 Sol in both efficiency and proficiency at vulnerability discovery and exploit development.
Why It Is Shipping Anyway
The obvious question: if the model can do that, why release it?
OpenAI’s position is that the risk of severe harm is sufficiently minimised by the safeguards now in place. The release was delayed specifically to build them, and the stated measures are:
- Refusal training — the model more reliably declines harmful cyber requests and respects safety restrictions.
- Additional misuse protections at the deployment layer, outside the model weights.
- Monitoring systems that can halt potentially unauthorised activity while it is happening.
- Staged access — the sharpest capabilities go to a small alpha group, not the general population.
The unstated argument underneath is the one the whole industry runs on: defenders benefit more than attackers from a capability that is expensive to replicate and cheap to distribute. A model that finds zero-days can be pointed at your own infrastructure before someone else points one at it. That is the entire premise of Daybreak Blue, OpenAI’s route for expanding defensive access.
Whether that argument holds is the live disagreement of 2026, not a settled matter. It is the same argument at the centre of the AI cyber defence open letter that circulated in August 2026.
Release Timing: What Is Known and What Is Not
Known: OpenAI confirmed Astra’s existence on August 1, 2026 after it produced breakthroughs in research-level mathematics, described it as “our next major model,” and said on September 1 that it had hit Critical cyber and would be available soon. Full safety, security and alignment evaluations are promised in the system card at launch.
Not known: the date. There is no committed public release date as of September 2, 2026.
Speculative: prediction markets on September 2 put roughly 86% on release by September 11 and 91% by September 15. Useful as a sentiment gauge; not a source. Note also that the model has been referred to variously as GPT-5.7 or GPT-6 Astra in secondary coverage — the branding is not settled, and any page that states it confidently is guessing.
What Developers Should Actually Do
Most teams will not touch Astra’s frontier cyber capability. The relevant consequences are indirect and worth acting on now:
Assume attacker capability rises on the same curve. The public argument is about which lab ships what. The operational reality is that automated vulnerability discovery is getting cheaper regardless of who ships first. Software that has never had an adversarial review is now on a shorter clock than it was in 2025.
Expect capability gating to become normal. Between Anthropic’s Mythos 5.1 trusted-access tier and OpenAI’s Astra alpha group, the pattern is set: for a narrow band of capability, who is asking determines what the model will do. If your product depends on a frontier model doing security-adjacent work, build the assumption of an access review into your roadmap.
Do not plan on Astra for anything with a deadline. No date, staged rollout, and a model whose defining feature is that it was delayed for safety work is not a dependency you schedule around. Build on GPT-5.6 Sol and treat Astra as an upgrade path.