Responding to the next frontier of critical cyber capabilities

OpenAI has announced preliminary cybersecurity evaluations for its upcoming model, Astra, revealing significant advancements in agentic coding and cybersecurity. According to the company, internal evaluations and expert assessments indicate that OpenAI cannot rule out critical cyber capabilities under its Preparedness Framework. Under this framework, a model reaches the critical threshold if it can autonomously identify and develop functional zero-day exploits in hardened critical systems or execute end-to-end novel cyberattacks. Previous models, such as GPT-5.6-Sol, were previously assessed at the high threshold. OpenAI stated that Astra was not involved in exploiting Hugging Face. In response to these findings, OpenAI has scaled up robustness testing and implemented stricter security controls for higher-capability models. These measures include isolated testing environments, restricted network and tool access, enhanced model weight protections, and sandboxed execution. Furthermore, OpenAI has paused internal activities involving Astra that do not yet meet these strengthened security requirements and introduced universal monitoring for risky actions. The company plans to work with relevant government agencies and select AI safety organizations to test the model capabilities further, aiming to ensure that frontier models are deployed responsibly to assist cyberdefenders before attackers exploit vulnerabilities.