OpenAI has confirmed that GPT-6 Astra, the flagship model it began rolling out in September 2026, is the first system the company has ever classified as “Critical” for cybersecurity capability under its internal Preparedness Framework. The disclosure, first published on OpenAI’s own safety overview page on September 3, 2026, and since dissected by outlets including BleepingComputer, CSO Online, and InfoQ, marks the first time a major AI lab has publicly admitted that one of its shipping products meets the top severe-harm threshold in its own safety framework rather than a lower, more comfortable tier.
For a company that just weeks earlier undercut its own pricing with the cheaper GPT-6 Sol and Luna models, the Astra disclosure lands very differently. This isn’t a benchmark bragging point. It’s OpenAI voluntarily telling regulators, security teams, and the public that its own flagship system can, under the right conditions, find and weaponize vulnerabilities that no human told it to look for.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What OpenAI Actually Disclosed About GPT-6 Astra
According to OpenAI’s own GPT-6 Astra announcement, the company stated plainly: “Astra is a significant jump in cyber capabilities and meets the Critical threshold in cybersecurity under our Preparedness Framework.” That line appears alongside the model’s system card on OpenAI’s Deployment Safety Hub, which also lists Astra as reaching the “High” level in the separate biological and chemical risk category.
Cybersecurity is one of three categories, alongside biological/chemical risk and AI self-improvement, that OpenAI’s Preparedness Framework tracks for every frontier model before release. Until Astra, no OpenAI model, including the earlier models compared in GPT-6 Astra’s own benchmark matchups against Gemini and DeepSeek, had publicly crossed the Critical line in any tracked category. OpenAI’s own safety overview describes Astra as “our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework,” a distinction the company chose to publish rather than quietly manage internally.
That choice matters. OpenAI could have kept the classification buried in a technical system card that few outside the security research community would ever read. Instead, it built a dedicated safety overview and a companion post explaining the reasoning, effectively getting ahead of the story rather than waiting for a leak or an outside researcher to surface it first.
Inside OpenAI’s Preparedness Framework: What “Critical” Actually Means
OpenAI’s Preparedness Framework is the company’s internal system for evaluating frontier models against categories of severe harm before those models ship. The framework has been revised multiple times since it first appeared in December 2023, and the current version, described in OpenAI’s own “Path to Astra” post, has narrowed its operational tiers. Where earlier iterations discussed four levels, from Low to Critical, OpenAI has since retired the “Low” and “Medium” labels because, per its own documentation, they were not operationally involved in triggering any actual safeguards.
That leaves two thresholds that actually do something: High and Critical. A model reaching High must have safeguards sufficient to minimize the associated risk before it can be deployed at all. A model reaching Critical, per OpenAI, must have safeguards addressing the risk during development itself, not just before the public gets access. In OpenAI’s own words from its safety overview: “We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework, meaning that with the right tools and access, it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.”
That single sentence is the crux of the entire story. It isn’t describing a model that’s merely good at explaining known CVEs or helping a junior analyst read a stack trace. It’s describing a system that OpenAI itself believes can autonomously discover flaws nobody has catalogued yet, then turn them into working attacks, inside systems that were specifically hardened against exactly that kind of intrusion.
The Two Conditions That Trigger the Critical Threshold
Per InfoQ’s breakdown of the framework, the Critical cybersecurity threshold is met if either of two conditions is satisfied: the model can identify and develop functional zero-day exploits across many hardened, real-world critical systems without human intervention, or the model can devise and execute end-to-end novel cyberattack strategies against hardened targets when given nothing more than a high-level goal. OpenAI’s own assessment concluded Astra satisfies at least the first of those conditions closely enough to warrant the classification. In its September 2026 safety review, OpenAI said it specifically observed Astra exploiting hardened browsers using previously unknown vulnerabilities, and separately found the model capable of constructing privilege-escalation exploits against hardened operating systems, two concrete instances the company cited as evidence that the first condition was met.
It’s worth being precise about what OpenAI is and isn’t claiming here. The company is not saying Astra can break into any system on demand, nor that the model acts autonomously in the wild without anyone deploying it that way. The classification describes a capability ceiling under favorable conditions, meaning what the model can do when given tools, compute, and access, not what it does by default inside ChatGPT’s consumer interface.
ExploitBench and ExploitGym: The Numbers Behind the Warning
The specific evidence behind the Critical rating comes from two internal benchmarks referenced in a research note the Cloud Security Alliance published on September 8, 2026. ExploitBench measures whether a model can take a known, already-disclosed vulnerability and turn it into a working exploit. ExploitGym is the harder test: more autonomous discovery-to-exploitation work against targets the model hasn’t been briefed on in advance.
On ExploitBench, GPT-6 Astra reportedly scored 100%, compared with 78.5% for the earlier GPT-5.6 Sol. On the tougher ExploitGym test, Astra scored 42.4% against 30.3% for GPT-5.6 Sol. The Cloud Security Alliance’s note is explicit that these figures come from OpenAI’s own internal, self-administered testing and have not yet been independently replicated by outside researchers, a caveat worth holding onto given how much weight the numbers are already carrying in coverage of the story.
| Benchmark | What It Measures | GPT-6 Astra | GPT-5.6 Sol |
|---|---|---|---|
| ExploitBench | Turning a known, disclosed vulnerability into a working exploit | 100% | 78.5% |
| ExploitGym | Autonomous discovery-to-exploitation against unfamiliar, hardened targets | 42.4% | 30.3% |
| Preparedness Framework cybersecurity tier | OpenAI’s official risk classification | Critical | Not disclosed as Critical |
| Preparedness Framework biological/chemical tier | OpenAI’s official risk classification | High | Not disclosed in public materials |
Source: Cloud Security Alliance research note and OpenAI’s GPT-6 Astra system card, both published in September 2026. Figures represent OpenAI’s internal testing and have not been independently verified by a third party at the time of writing.
A perfect score on a benchmark built around known vulnerabilities is a useful signal, but the ExploitGym number is the one that should worry defenders more. A jump from roughly 30% to over 42% on genuinely novel discovery work, in the space of a single model generation, is the kind of trajectory that framework designers built the Critical tier to catch before it becomes a bigger jump the next time around.
Why OpenAI Shipped Astra Anyway
Reaching Critical didn’t stop OpenAI from releasing GPT-6 Astra, but it wasn’t a straightforward public launch either: starting September 22, 2026, OpenAI limited Astra’s initial rollout to verified organizations rather than opening it to individual consumer accounts outright. Per CSO Online’s reporting, the classification triggered what the company describes as additional deployment restrictions, layered on top of the safeguards that already apply at the High tier. OpenAI’s system card frames it the same way: “Astra is a significant step up in cyber capabilities and meets our Critical threshold,” language paired with a description of the extra monitoring and access controls the company says it applied before allowing the model to ship.
BleepingComputer’s coverage captured the tension well, describing Astra as a model that is, in the company’s own telling, safer overall but harder to inspect. That’s the uncomfortable trade embedded in this entire story. OpenAI’s safeguards for a Critical-tier model are supposed to work during development, before a system like Astra ever reaches a customer, rather than relying solely on filters bolted on at the API layer afterward. Whether that development-time approach holds up against a model this capable is precisely the question outside researchers can’t fully answer, since they don’t have access to OpenAI’s internal red-teaming results beyond what the company chooses to disclose.
That’s a familiar pattern for anyone tracking OpenAI’s safety disclosures this year. The company previously acknowledged a cluster of AI safety incidents across its model lineup, and separately confirmed that Astra could be jailbroken by other instances of itself during testing. The Critical cybersecurity rating is a third data point pointing the same direction: a company shipping increasingly capable systems while publishing, in more detail than most competitors, exactly how those systems can go wrong.
How Rivals Stack Up: Anthropic’s ASL-3 and Google’s Critical Capability Levels
OpenAI isn’t the only lab running a frontier-risk classification system, and the comparison is instructive. Anthropic’s equivalent is its Responsible Scaling Policy, which assigns models an AI Safety Level, or ASL, running from ASL-1 up through ASL-4. According to Anthropic’s own Transparency Hub, the company’s Claude Fable 5.1 model was deployed with ASL-3 protections and is treated as having “CB-1” cybersecurity capabilities, a lower public designation than OpenAI’s Critical tier for Astra. Anthropic’s newer Claude Opus 5.5, which launched roughly the same week as this story broke, is described by the company as shipping with a similar class of safeguards to Fable 5.1, though Anthropic has not published an explicit ASL-4 classification for it.
Google DeepMind runs a structurally different system called the Frontier Safety Framework, built around what it calls Critical Capability Levels, or CCLs. Per Google DeepMind’s own framework documentation, the current version defines five CCLs and two Tracked Capability Levels spanning CBRN uplift, cyber uplift, harmful manipulation, machine-learning research and development, and misalignment-related ML R&D risks. As of this reporting, there is no public confirmation from Google that any Gemini model, including the Gemini 3.8 family, has actually triggered one of those CCL thresholds the way Astra triggered OpenAI’s Critical tier.
| Company | Framework | Key Tiers | Latest Flagship | Highest Disclosed Classification |
|---|---|---|---|---|
| OpenAI | Preparedness Framework | High, Critical (Low/Medium retired) | GPT-6 Astra | Critical (cybersecurity), High (biological/chemical) |
| Anthropic | Responsible Scaling Policy (ASL) | ASL-1 through ASL-4 | Claude Opus 5.5 / Fable 5.1 | ASL-3 protections, CB-1 cybersecurity (Fable 5.1, per Anthropic) |
| Google DeepMind | Frontier Safety Framework | 5 Critical Capability Levels + 2 Tracked Capability Levels | Gemini 3.8 family | No CCL publicly confirmed as triggered |
Source: OpenAI Deployment Safety Hub, Anthropic Transparency Hub, and Google DeepMind Frontier Safety Framework documentation, as published through September 2026. There is no verified, comprehensive public count of how many frontier models worldwide currently sit at the highest tier of their respective frameworks, so any such total should be treated as unconfirmed.
The comparison puts OpenAI in an odd spot. It’s the only one of the three labs to publicly confirm a model has hit the absolute top of its own risk scale for cybersecurity specifically. That could reflect Astra genuinely being ahead on offensive cyber capability, or it could reflect OpenAI simply being more willing to say the quiet part in public than its rivals. Both readings currently coexist in the coverage, and neither can be fully ruled out from the outside.
Historical Context: How AI Risk Classification Got Here
OpenAI’s Preparedness Framework dates back to December 2023, introduced as a direct response to mounting pressure from researchers and policymakers who argued that frontier labs needed a structured, published process for evaluating catastrophic-risk capabilities before release, rather than relying on ad hoc internal judgment calls. In its early form, the framework’s tiers were largely theoretical exercises: models were evaluated, scored, and in every public case landed comfortably below the top threshold.
That changed gradually across 2025 and into 2026 as models gained the kind of agentic, tool-using capability that turns “can explain a vulnerability” into “can find and exploit one end to end.” The same period saw OpenAI, Anthropic, and Google all separately expand their safety frameworks to account for autonomous cyber capability specifically, rather than treating it as a subcategory of general capability. Astra’s Critical classification is best understood not as a sudden jump but as the point where a multi-year trend line, tracked quietly in system cards that few people read, finally crossed a threshold that forces a real decision rather than a footnote.
It also arrives against a backdrop of broader industry anxiety about autonomous AI behavior. OpenAI, Anthropic, and Google have all held direct safety coordination talks in 2026, and separate research from Palo Alto Networks’ Unit 42 has already documented AI agents compromising a company’s systems in a matter of hours during controlled testing. Astra’s Critical rating slots directly into that narrative: capability is climbing faster than the industry’s ability to fully verify how contained it actually is.
What Security Researchers and Analysts Are Saying
Coverage from the security research and industry-analysis side has focused less on panic and more on precedent. The Cloud Security Alliance’s research note frames the moment as the arrival of autonomous zero-day exploitation as a documented, disclosed capability, rather than a theoretical future risk. Its authors are careful to flag that the benchmark numbers behind that framing are self-reported by OpenAI and still await independent replication, a distinction that matters for anyone deciding how much weight to put on the 100% ExploitBench figure specifically.
Analysis from the Futurum Group has centered on the market and enterprise-risk angle rather than the technical one, framing the Critical designation as a signal that security buyers now need to factor frontier-model capability drift into their own risk models, not just their vendor’s. Forbes’ coverage, meanwhile, has focused on the governance optics of the disclosure itself, treating OpenAI’s decision to publish a Critical rating for its own flagship product as a test case for whether voluntary safety disclosure from AI labs is a durable practice or a one-off moment of transparency that won’t necessarily repeat with the next model generation.
Market Impact: What This Means for Enterprises and Security Teams
For CISOs and security engineering teams, the practical takeaway isn’t that GPT-6 Astra is about to start autonomously breaching their networks. It’s that the tooling gap between AI that helps a human write an exploit and AI that finds and writes the exploit largely on its own is closing faster than most enterprise security roadmaps currently assume. Teams that built their 2026 threat models around AI-assisted phishing and social engineering now need to account for AI-assisted vulnerability discovery against their own infrastructure as a near-term, not hypothetical, category.
That has direct implications for how organizations approach both offense and defense. On the defensive side, the same capability that makes Astra risky in the wrong hands makes it valuable for legitimate red-teaming and vulnerability management, which is one reason OpenAI hasn’t simply refused to ship the model at all. Enterprises already experimenting with structured AI red-teaming tooling are likely to see faster adoption pressure now that a Critical-tier model is commercially available through OpenAI’s API, gated by whatever access controls the company has layered on top.
On the vendor side, expect procurement and security review processes at large enterprises to start asking AI vendors directly which Preparedness Framework, ASL, or CCL tier their models sit at, the same way those processes already ask about SOC 2 or ISO 27001 status. A Critical or CCL-triggering rating may soon function less like an obscure technical footnote and more like a line item that shows up in vendor risk assessments and cyber insurance underwriting conversations.
The Regulatory and Policy Fallout
The disclosure lands in the middle of an already active US policy debate over frontier AI oversight. Lawmakers have spent much of 2026 sparring over proposals that would give regulators more direct authority over how the largest AI labs handle exactly this kind of capability disclosure, including a bill that Senator Rand Paul has moved to block that would have covered OpenAI, Anthropic, Google, and other major labs directly.
OpenAI’s decision to publish the Critical classification voluntarily, rather than waiting for a mandate to force disclosure, is likely to be cited on both sides of that debate. Advocates of lighter-touch regulation will point to it as proof that voluntary frameworks are already working as intended. Advocates of mandatory oversight will point to the same disclosure as evidence that a company can reach the top of its own risk scale and still choose, unilaterally, exactly how much detail to share and when, without any external body confirming the assessment independently.
Competitive and Business Stakes for OpenAI
There’s also a straightforward commercial dimension here. GPT-6 Astra is OpenAI’s premium flagship model, sitting above the cheaper Sol and Luna variants the company introduced to compete more directly on price. A Critical cybersecurity rating is, in a strange way, also a capability claim: OpenAI is telling enterprise customers that Astra is powerful enough to matter for serious security use cases, even as it simultaneously tells them to expect tighter access controls before they can use it for exactly that purpose.
That’s a harder needle to thread than it might look. Competing too aggressively on raw offensive-security capability risks accelerating exactly the kind of scrutiny that slows enterprise sales cycles down, while underselling the capability risks ceding the security-and-red-teaming market to Anthropic, Google, or specialized security AI vendors who can point to lower-tier safety classifications as a selling point of their own.
What Comes Next: Predictions
- Independent replication attempts will follow. Given that the Cloud Security Alliance flagged the ExploitBench and ExploitGym figures as self-reported, expect independent security research groups to attempt their own replication of Astra’s benchmark performance within the next few months.
- Anthropic and Google will face pressure to clarify their own tiers. With OpenAI now the only lab to publicly confirm a Critical-equivalent rating, expect renewed questions about whether Claude Opus 5.5 or upcoming Gemini releases are approaching similar thresholds under ASL or CCL frameworks.
- Enterprise AI vendor risk assessments will start referencing Preparedness Framework tiers explicitly. Security procurement teams are likely to add framework-tier questions to vendor questionnaires within the next one to two enterprise sales cycles.
- Expect renewed legislative attention. A voluntary Critical disclosure from the industry’s highest-profile lab gives both sides of the US AI oversight debate new material, and it’s likely to resurface in upcoming hearings regardless of how the current kill-switch bill fares.
- Access controls around Astra’s cyber capabilities will keep tightening rather than loosening. Given that OpenAI has already layered additional deployment restrictions on top of the base model, further gating for advanced cybersecurity use cases is a more likely near-term move than any relaxation.
Frequently Asked Questions About GPT-6 Astra’s Critical Rating
What does “Critical” mean under OpenAI’s Preparedness Framework?
It’s the top operational threshold in OpenAI’s internal risk-tracking system for frontier models. Per OpenAI’s own documentation, a model reaches Critical if it can identify and develop functional zero-day exploits across many hardened real-world systems without human help, or devise and execute end-to-end cyberattack strategies from just a high-level goal.
Is GPT-6 Astra the first AI model ever to reach a Critical safety classification?
It’s the first OpenAI model to reach Critical specifically in the cybersecurity category under OpenAI’s own framework, according to the company’s safety overview and system card. There is no verified public record confirming or denying whether a model from another lab has reached an equivalent tier under a different framework, since each lab’s classification system is structured differently.
Can GPT-6 Astra actually hack into systems on its own?
OpenAI’s classification describes a capability ceiling under favorable conditions, meaning what the model can do when given the right tools and access, not something it does autonomously by default inside consumer products like ChatGPT. OpenAI says it has applied additional deployment restrictions specifically because of this classification.
What is ExploitBench and how did GPT-6 Astra score on it?
ExploitBench tests whether a model can turn a known, already-disclosed vulnerability into a working exploit. Per a Cloud Security Alliance research note, GPT-6 Astra scored 100% on this benchmark, compared with 78.5% for GPT-5.6 Sol. These figures are self-reported by OpenAI and have not yet been independently replicated.
How does this compare to Anthropic’s Claude models?
Anthropic’s Claude Fable 5.1 was deployed with ASL-3 protections and is treated as having CB-1 cybersecurity capabilities, according to Anthropic’s Transparency Hub, a lower public designation than OpenAI’s Critical tier for Astra. Anthropic has not published an explicit ASL-4 classification for its newer Claude Opus 5.5 model.
Has any Google Gemini model reached a similar threshold?
There is no public confirmation from Google DeepMind that any Gemini model has triggered one of the five Critical Capability Levels defined in its Frontier Safety Framework, based on the company’s own published framework documentation.
Does the Critical rating mean OpenAI will restrict who can access GPT-6 Astra?
OpenAI has confirmed the classification triggers additional deployment restrictions on top of standard safeguards, according to CSO Online’s reporting on the disclosure, including limiting Astra’s initial rollout, starting September 22, 2026, to verified organizations rather than general consumer accounts, though OpenAI has not published a complete public list of every specific access control involved.
What should enterprise security teams do in response to this news?
Security teams should treat AI-assisted vulnerability discovery as a near-term threat category rather than a future hypothetical, review vendor AI risk disclosures more closely, and consider how tools built on Critical-tier models might factor into both their offensive red-teaming programs and their defensive threat modeling going forward.
Related
- GPT-6 Astra Jailbroke Itself: OpenAI Blocks 91.5% [2026]
- GPT-6 Sol, Luna Undercut Claude Opus 5.5 by 50% [2026]
- OpenAI Admits 6 AI Models Went Rogue: 2.15% Rate [2026]
- OpenAI, Anthropic, Google in AI Safety Talks: 5 Labs [2026]
- Unit 42: AI Agents Breach Firm in 10 Hours, 50+ TTPs [2026]
Related Coverage
- Anthropic Weighs New AI Model as Astra Hits 13% [2026]
- GPT-6 Astra vs Gemini 3.8 vs DeepSeek V4.1: 83x Gap [2026]
- Muse Spark Tops GPT-6 Astra, Claude Fable: 75% SWE [2026]
- OpenAI Claims 100+ Math Problems Solved in 24 Days [2026]
- Claude Fable 5.1 vs GPT-5.6 Sol vs GLM-5.3: 96% SWE [2026]
