OpenAI has unveiled a major leap forward in AI-based cybersecurity. Its latest model, Astra, has officially crossed into the company’s “Critical” capability tier—meaning it can independently identify previously unknown vulnerabilities in hardened systems and craft working exploits. The designation requires a model to discover zero-day exploits or execute novel end-to-end cyberattacks without step-by-step human guidance. Astra hit both marks after extensive evaluations.
What Astra Does Differently
According to recent tests, Astra outperforms GPT-5.6 Sol in uncovering flaws and building exploit chains. In one browser security trial, the model discovered a hidden vulnerability that allowed it to break out of a sandbox when a user opened a malicious HTML file. In another case, it elevated from a low-privilege user account to root access on a hardened operating system. Finding and chaining vulnerabilities in this way is particularly dangerous because gaining root access often means full control of the machine.
To validate this ability, OpenAI used both public benchmarks and private high-severity vulnerability sets. On the public ExploitBench test, Astra achieved a perfect 100% score for exploiting known flaws. It then showed superior performance against a set of 20 recently disclosed serious vulnerabilities in V8, demonstrating better arbitrary code execution success than GPT-5.6 Sol—even while producing fewer output tokens. In these internal evaluations Astra also discovered two new zero-day bugs, which OpenAI is disclosing responsibly.
Stronger Safeguards Accompany the Power
While Astra’s capabilities are potent, OpenAI is adding layers of protection to prevent misuse. Its preparedness framework for Critical models requires robust safeguards. In Astra’s case, OpenAI added refusal training, improved classifiers at the system level, stricter monitoring, limited network/tool access, executing tasks in sandboxed isolated environments—all intended to block unauthorized or dangerous behavior.
In comparative testing, Astra refused 91.5% of prompts in a specialized “cyber jailbreak” set, compared to just 59% for GPT-5.6 Sol. In simulated honeypot scenarios, Astra didn’t make any successful attempts to access or damage surrounding systems. Without production-grade protections, GPT-5.6 Sol breached honeypot targets in over half of those same tests. These results came from tightly controlled settings—not from public or general usage.
Initially, Astra won’t be widely available. OpenAI plans to roll it out first to a limited cohort of testers, then broaden access through its Daybreak Blue program focused on defensive cybersecurity. Developers and defenders will likely get access first.
While some legitimate security research—especially long-running or experimental agent‐based tasks—might hit friction due to stricter oversight, the shift marks a turning point in how AI supports cybersecurity. Astra may help defenders find and patch critical vulnerabilities before adversaries latch on, but it also underscores how much care is required when models gain so much autonomy. Rigorous access controls, continuous monitoring, clear alignment of safety goals, and incident response readiness are more essential than ever.
