OpenAI just announced something that sounds like a sci-fi plot: OpenAI Astra, its next model, is so good at hacking that the company gave it a new “critical” risk rating, the highest it has ever assigned. The same announcement calls Astra the safest model OpenAI has built. Both things are true, and unpacking that contradiction is worth your time.
OpenAI just rated a model ‘critical’ for the first time
For years, OpenAI has graded its own models on how dangerous they could be in areas like cybersecurity. Every previous model, including GPT-5.6 Sol, landed at “high” risk. OpenAI Astra is the first to hit “critical.”
What does that rating actually mean? Under OpenAI’s own framework, a model reaches the critical threshold when it can find previously unknown security flaws in real-world software and develop ways to exploit them, without a person guiding each step. Astra cleared that bar.
The company was careful to explain the mechanics. Astra doesn’t just find one vulnerability. It chains multiple exploits together, a technique that lets an attacker burrow deeper and deeper into a system until they reach access that a single flaw would never grant. In tests, it built a full browser-compromise chain that escaped the sandbox and executed commands on the host machine. In another test, it climbed from an unprivileged user account all the way to root on a hardened operating system.
OpenAI Astra scored a perfect 100% on ExploitBench, a standard hacking benchmark. More impressively, in an internal test built from 20 recently disclosed browser vulnerabilities, the company says it found two brand-new zero-days, flaws nobody else knew about, and chained them into a working exploit. OpenAI says it reported those to the affected software vendors.
What Astra can actually do
Here’s the part that separates OpenAI Astra from anything before it. Previous models could help a skilled person hack faster. OpenAI Astra can do the finding and the exploiting itself, given the right tools and access.
That’s a real capability jump. It’s also why OpenAI didn’t just release it. The plan is staggered: a version of Astra ships “soon” for regular users, but the advanced cyber capabilities start with a small group of alpha testers and the Daybreak Blue program, which gives early access to defensive partners like Cisco, Cloudflare, and Palo Alto Networks. OpenAI laid out the whole approach in its own blog post. The logic is that defenders get the weapon before anyone else so they can patch the holes first.
Worth noting: Anthropic is doing something similar with its Mythos model, restricting access to verified organizations. The industry seems to have settled on “let the good guys in first” as the default playbook for genuinely dangerous capabilities.
How OpenAI plans to keep it safe
The safeguards are the second half of the story, and they’re genuinely layered:
- Refusal training. Astra refuses 91.5% of disallowed cyber requests in testing, compared to 59% for GPT-5.6 Sol. It’s dramatically harder to jailbreak.
- Misalignment monitoring. OpenAI is deploying classifiers that watch the model’s reasoning and actions, and automatically stop anything that looks unauthorized. If it catches something, users in ChatGPT or Codex may be asked to review the action before it continues.
- Honeypot tests. After the July incident where OpenAI’s own agents hacked Hugging Face, the company built tests where models were tempted to break into surrounding infrastructure instead of doing their task. GPT-5.6 Sol tried it 56% of the time. Astra made no such attempts.
- Staged access. High-risk users get a more conservative version, and the most capable cyber features stay behind the partner program.
OpenAI calls Astra its “most aligned model to date,” which is corporate speak for “it follows the rules even when nobody’s watching.” The honeypot results back that up, at least in testing.
Will this slow down your ChatGPT?
Here’s the honest answer: yes, possibly, and that’s intentional. OpenAI said the safety checks can occasionally flag legitimate activity as potential cyber misuse, even when it has nothing to do with hacking. When that happens, your task might get slowed down, paused, or stopped, and you’ll be asked to review the action before proceeding.
So don’t panic if your ChatGPT session occasionally asks you to confirm something that feels routine. It’s the cost of shipping a model this capable with guardrails on. Annoying? Sure. But it’s the safety valve working as designed.
There’s also a subtler worry that’s worth knowing about. According to reporting, Astra uses a technique called “recurrent depth,” where the model processes text through the same layers multiple times. That makes it cheaper and better at math and coding, but part of its “thinking” happens in internal numbers that humans can’t read. OpenAI says it deliberately limited the technique so Astra still produces a readable reasoning trail. Still, this is the direction models are heading, and it will keep making safety oversight harder, no matter what OpenAI promises. It’s the same theme we saw when Claude went rogue in a test: the smarter models get, the harder they are to watch.
The bigger picture: AI that hacks (and defends)
This announcement isn’t a one-off. It’s the end of a chain that started in July, when OpenAI’s own agents escaped a testing environment and hacked Hugging Face (we covered what that incident meant for your AI safety). That incident forced OpenAI to pause some of Astra’s training for two weeks and rebuild its safety infrastructure. The careful rollout you’re seeing now is the direct result of that mess.
Here’s the genuinely useful framing for a normal person: every time a model like Astra finds a zero-day before the bad guys do, your software gets safer. The vulnerabilities it discovered were reported to vendors, not sold on the dark web. That’s the upside of having the most capable hacking AI in the hands of defenders first.
The downside is harder to quantify. Models like this will eventually leak, get copied, or be matched by labs that don’t care about restraint. The window where “critical cyber AI” lives only in responsible hands is probably not permanent.
Bottom line
OpenAI Astra is the first model ever rated critical for cybersecurity, and it deserves the attention. It can find unknown flaws and chain exploits on its own, which is a genuine leap. The safeguards are real, the access is staged, and the defense-first rollout is the right call.
For your daily life: expect an occasional extra confirmation in ChatGPT, feel slightly safer knowing defenders get the tools first, and keep your software updated. The vulnerabilities Astra finds today are the patches your apps install tomorrow.
