GPT-6 Astra achieves a perfect score on ExploitBench, but OpenAI blocks PoC exploit creation

OpenAI has unveiled GPT-6 Astra, a model capable of achieving a 100% score on ExploitBench, a benchmark that evaluates how well models can turn known vulnerabilities into working exploits. The news, which emerged on September 4, 2026, comes as the company restricts access to its most sensitive offensive capabilities.

Astra has reached the “Critical” cybersecurity capability threshold defined by OpenAI’s Preparedness Framework. As a result, the initial release can assist with secure code review and patch preparation, but refuses direct requests to produce proof-of-concept exploits.

The model will be rolled out gradually through ChatGPT, OpenAI API, and third-party cloud infrastructure. At the same time, OpenAI has committed $1 billion to support defensive use by organizations with limited security resources.

From 78.5% to 100% in exploit generation

ExploitBench measures whether a model can start with known software vulnerabilities and produce a genuinely working exploit. It therefore evaluates more than the ability to explain a flaw or suggest plausible code: the result depends on whether the exploit works in the test environment.

GPT-6 Astra completed the benchmark with a 100% score. OpenAI’s previous frontier cybersecurity model, GPT-5.6 Sol, achieved 78.5%.

The gap is significant because exploit development requires several coordinated steps. The model must understand the root cause of the vulnerability, identify the conditions required to trigger it, and build an input capable of controlling the program’s behavior. It must then adapt the code to the protections in place and fix errors that emerge during testing.

OpenAI also reports that Astra achieves substantially higher arbitrary code-execution rates than GPT-5.6 Sol. The tests covered vulnerabilities disclosed during the previous three months, including June through August 2026, as well as two zero-day vulnerabilities.

The software involved in the zero-day tests was not identified. The release also provided no CVE identifiers, affected versions, or vendor names. As a result, administrators and security teams have no specific indicators to look for or particular products to update based on these evaluations.

The perfect score also remains a result tied specifically to ExploitBench. It does not demonstrate that Astra can exploit any vulnerability in every environment, configuration, or architecture.

Attacks against browsers and hardened operating systems

OpenAI’s evaluations go beyond exploiting previously documented flaws. Without safeguards, Astra would be able to identify previously unknown vulnerabilities and use them to achieve code execution in hardened browsers.

The model reportedly also demonstrated the ability to develop privilege-escalation exploits against hardened operating systems. Such an attack typically starts with access under limited permissions and attempts to obtain higher privileges needed to modify the system, steal credentials, or compromise other users.

The reference to hardening is significant. It points to environments where configurations and protections have been applied to reduce the attack surface. However, OpenAI has not specified which mitigations were active, which browsers and operating systems were examined, or what the initial level of access was.

It is therefore impossible to independently assess the technical scope of the vulnerabilities, reproduce the results, or determine whether the flaws have been fixed. The available information describes the model’s capabilities; it is not a security advisory that can be used to apply a patch.

The initial release excludes proof-of-concept exploits

The first GPT-6 Astra rollout is limited to a small group of organizations. At this stage, the model is restricted to activities such as secure code analysis and applying fixes.

Requests to create PoC exploits for vulnerabilities are refused. The restriction is intended to prevent a capability designed to accelerate vulnerability validation from also reducing the operational cost of attacks.

The distinction is not always clear-cut. A proof-of-concept may be necessary for a defender to confirm a vulnerability, validate a patch, or build a detection rule. The same code, however, can be adapted to target exposed systems.

OpenAI acknowledges that the controls may also block legitimate activity. When a defensive operation is interrupted, the user must review it before continuing. In sensitive environments, the model’s behavior is adjusted according to the risk associated with the requested actions.

Through OpenAI Daybreak, the company plans to expand access and introduce less restrictive safeguards in the following weeks. Planned capabilities include vulnerability and PoC validation, malware analysis, and detection engineering.

Monitoring, jailbreaks, and action controls

OpenAI says it has strengthened Astra against jailbreaks, meaning attempts to bypass its operating rules through manipulative instructions, carefully constructed contexts, or sequences of seemingly harmless requests.

The context available to monitoring systems has also been expanded. This should allow the controls to assess not only the latest instruction, but a broader portion of the model’s activity and the environment in which it operates.

Additional mechanisms are intended to identify and contain potential misalignment. Astra should more consistently follow both the limits explicitly set by the user and those implied by the operating environment, such as permissions, test scope, and the systems it is authorized to affect.

In an evaluation built around tasks selected to elicit misbehavior, Astra was more successful at avoiding unintended consequences. Running with additional security measures enabled by default improved the results further.

No detailed figures were published on false positives, successful jailbreak attempts, or quantitative comparisons with other models. It therefore remains to be seen how these controls will perform in real-world operations, where defensive and offensive requests may have nearly identical technical structures.

Access through ChatGPT, API, and cloud platforms

After the initial phase, OpenAI plans to make GPT-6 Astra available to users on the following plans:

• ChatGPT Plus;
• ChatGPT Pro;
• ChatGPT Business;
• ChatGPT Enterprise.

The model will also be available through OpenAI API, Microsoft Azure, and Amazon Web Services Bedrock. OpenAI has not disclosed a detailed rollout schedule, pricing, usage limits, or any verification requirements for accessing its cybersecurity capabilities.

Beyond cybersecurity, Astra is positioned as a flagship model for computer use, web browsing, software engineering, scientific research, and professional work. OpenAI reports a 98% score on FrontierMath Tier 4 and 99.9% on ARC-AGI-3.

For organizations, availability through APIs and cloud platforms also raises governance concerns. Adoption will require precise authorization, activity logging, isolated test environments, and human review of the results. A model capable of modifying code and using external tools should not automatically be granted access to production systems.

$1 billion for frontline defenders

Alongside the launch, OpenAI announced Daybreak for Frontline Defenders, a global program backed by a stated financial commitment of $1 billion.

The initiative will provide subsidized access to models, hands-on training, and technical assistance. Recipients include water systems, electricity providers, state and local governments, banks, non-profit organizations, and open-source maintainers.

These organizations are often exposed to sophisticated attacks but lack the staff needed to rapidly analyze vulnerabilities, malware, and large volumes of logs. In this context, Astra could accelerate code review, patch preparation, and the development of detection mechanisms.

OpenAI also announced a pilot project with the U.S. Multi-State Information Sharing and Analysis Center (MS-ISAC). An initial group of public-sector and water-system defenders will receive Daybreak access, guided training, and hands-on assistance.

The central challenge will be keeping the advantage on the defenders’ side. The 100% score on ExploitBench shows that automated exploit generation has crossed a concrete technical threshold; the initial refusal to produce PoCs shows, at the same time, that deploying this capability requires controls different from those applied to a standard software assistant.