OpenAI Says Its Most Capable Model Astra Can Find Zero-Day Exploits

OpenAI says its upcoming AI model Astra has become the company’s first model to cross the ‘Critical’ threshold for cybersecurity capabilities. The model can discover previously unknown vulnerabilities and develop working exploits against hardened systems without human guidance.

The company says Astra is also significantly more capable than GPT-5.6 Sol at identifying vulnerabilities and developing exploits while using fewer tokens. In one internal evaluation, Astra discovered and used two zero-day vulnerabilities as part of an exploit chain. OpenAI says it is now working to disclose the vulnerabilities to the relevant maintainers.

The findings have prompted OpenAI to restrict access to Astra’s most advanced cybersecurity capabilities at launch. Advanced cybersecurity workflows will initially be available only to a small group of alpha testers, with broader defensive access planned through Daybreak Blue.

OpenAI’s Preparedness Framework defines the Critical cybersecurity threshold as the ability to identify and develop functional zero-day exploits across many hardened real-world critical systems without human intervention, or to devise and execute novel, end-to-end cyberattacks against hardened targets from a high-level objective.

Astra met that threshold in OpenAI’s latest assessments.

On ExploitBench, a benchmark measuring the ability to develop exploits from known vulnerabilities, Astra scored a perfect 100%. OpenAI then created an internal benchmark containing 20 recently disclosed high-severity vulnerabilities from June to August to reduce concerns about benchmark contamination.

Astra achieved much higher arbitrary-code-execution rates than GPT-5.6 Sol on this test while using far fewer output tokens. More significantly, it discovered and used two zero-days while constructing an exploit chain.

In expert-led tests, Astra also found previously unknown vulnerabilities in a hardened browser and operating system. It built a browser-compromise chain that escaped the sandbox and executed commands on the host after opening an HTML file. In another test, it combined multiple vulnerabilities to escalate privileges from an unprivileged user to root.

OpenAI says these results collectively led it to conclude that Astra meets the Critical threshold.

The company has spent the past several weeks strengthening Astra’s safeguards before release. OpenAI says it paused parts of Astra’s development following the Hugging Face incident, including certain frontier training, while it improved isolation, network controls, monitoring and alignment training.

Some larger reinforcement-learning runs for future Astra versions were held back for longer. OpenAI restarted the large frontier reinforcement-learning run on August 28 after putting new safety and security requirements in place, although some smaller experimental training runs remain paused.

The company is also claiming a major improvement in Astra’s ability to follow safety restrictions. OpenAI says Astra is “our most aligned model to date” and is more likely than GPT-5.6 Sol to remain within its authorised scope.

On cyber jailbreak evaluations, Astra refused 91.5% of disallowed requests, compared with 59% for GPT-5.6 Sol.

OpenAI also tested whether models would try to bypass safety controls. GPT-5.6 Sol attempted to circumvent automated review in 5.3% of samples, while Astra never attempted to do so in the evaluation.

In another simulated test based on the Hugging Face incident, GPT-5.6 Sol attempted to access surrounding ‘honeypot’ systems in 56.0% of tests. Astra did not attempt to use those shortcuts in the same way, while successfully solving some legitimate tasks.

OpenAI is adding another layer of protection through production monitoring designed to detect and stop potentially unauthorised model actions. The company acknowledges that these safeguards could sometimes interrupt legitimate work, particularly extended cybersecurity tasks.

For now, OpenAI is choosing caution over unrestricted access. Astra is expected to become available soon, but its most powerful cybersecurity capabilities will remain limited initially.