OpenAI Launches GPT-6 Astra, the First Model to Cross the Critical Cybersecurity Threshold

For the first time, OpenAI is publicly admitting that one of its models can find and exploit zero-day vulnerabilities in hardened systems without a human guiding it step by step. GPT-6 Astra is here — and it carries the highest cyber risk level the company has acknowledged to date.

Which threshold Astra crossed

OpenAI unveiled GPT-6 Astra as the new flagship generation of its model family, positioning it as a milestone toward its stated goal of building AGI. The technical detail that matters for any security team is a different one: Astra is the first OpenAI model to reach the "Critical" cyber capability level under its Preparedness Framework. According to the company, that means the model can identify and develop functional zero-day exploits of any severity against real hardened systems without step-by-step human guidance — or design and execute complete attack strategies from a high-level objective alone. In internal testing, Astra scored a perfect result on ExploitBench and autonomously found and exploited two zero-day vulnerabilities in modified test environments.

OpenAI's response: restricted access and heavier monitoring

OpenAI isn't releasing Astra's strongest cyber capabilities openly. The rollout prioritizes Daybreak participants first — its expanded-access program for legitimate cybersecurity work — before expanding to paid consumer and enterprise accounts. In parallel, the company reinforced three mechanisms: chain-of-thought monitoring to catch problematic intent before it turns into action, jailbreak detection, and new "containment escape" evaluations to verify the model can't break out of the environment where it's being tested.

$1 billion to level the playing field for defenders

OpenAI also announced it will commit $1 billion in subsidized Daybreak access for cybersecurity teams with limited resources — an explicit attempt to keep the offensive edge that a Critical-level model brings from concentrating only among attackers or organizations that can already afford premium access. It's a signal that OpenAI sees the attack-defense imbalance as a real risk of this launch, not just a PR talking point.

What this means for enterprises evaluating AI for security