OpenAI Astra Reaches “Critical” Capability Level: Model Can Find Zero-Days and Complete Attack Chains

OpenAI has classified Astra, its latest model, at the “Critical” cybersecurity capability level defined by its Preparedness Framework. It is the first time one of the company’s models has reached this threshold.

The news, which emerged on September 2, 2026, does not concern a vulnerability in Astra, but rather its offensive capabilities. According to OpenAI’s stated assessments, the system can autonomously identify and exploit zero-day vulnerabilities or carry out a complete attack against a suitably protected target from a high-level instruction.

The tests also reportedly covered browser sandbox escapes, vulnerability chaining, and root-level privilege escalation. OpenAI therefore will not immediately make the model’s full cybersecurity capabilities broadly available.

The findings were disclosed by the company. No independent verification of the evidence has been provided.

What the “Critical” Classification Means

The “Critical” level does not simply measure a model’s ability to generate code, analyze logs, or suggest security techniques. It identifies a system capable of carrying out autonomous offensive sequences against defended targets.

Under OpenAI’s Preparedness Framework, the threshold can be reached through at least one of two scenarios. The first is the autonomous discovery and exploitation of zero-day vulnerabilities across numerous adequately protected systems. The second is completing an attack against a hardened target based on generic instructions.

Astra is said to have demonstrated capabilities consistent with these scenarios. The qualitative leap lies primarily in its autonomy: the model is not limited to assisting with a single phase, but can connect reconnaissance, vulnerability research, exploitation, isolation bypass, and privilege escalation.

This reduces the level of human oversight required to turn a software flaw into a real compromise. It may also shorten the time between identifying a weakness and producing a usable exploit.

However, no malicious campaigns have been attributed to Astra. The model has not been linked to criminal groups, state-sponsored operators, or other threat actors.

Perfect ExploitBench Score and Two Zero-Days Identified

Astra achieved the highest possible score on ExploitBench, a benchmark that evaluates the ability to turn known vulnerabilities into working exploits. The result indicates operational exploitation skills, not merely the ability to explain a flaw in theoretical terms.

A perfect score on this type of test suggests that the model can interpret the available information, identify the conditions required for an attack, and produce a procedure capable of exploiting the issue. On its own, however, it does not demonstrate the ability to discover new vulnerabilities.

For that reason, OpenAI conducted a separate evaluation based on more recently disclosed vulnerabilities. In that assessment, Astra reportedly identified two zero-days autonomously.

The company has not disclosed the affected products, versions, vendors, or CVE identifiers. It is therefore impossible to determine the technical nature of the two flaws, verify whether they have been fixed, or assess the exposure of real-world systems.

Details about the methodology are also missing: the sample size, operating conditions, tools made available to the model, and any human oversight have not been disclosed. This information would be necessary to reproduce the results and compare them with those of other systems.

From Sandbox Escape to Root Privileges

The most significant tests involved a multi-stage attack chain. Astra reportedly escaped a browser sandbox and executed commands on the underlying machine.

A sandbox is designed to confine browser code and prevent a compromise of the process from spreading to the operating system. Crossing that boundary turns an application-level vulnerability into a broader point of access.

The model also reportedly chained multiple flaws within a hardened operating system, meaning one configured with additional security controls and restrictions. The chain allegedly resulted in root-level access.

OpenAI has not identified the browser, operating system, hardening configuration, or vulnerabilities used. It is therefore impossible to determine whether the attack relied on memory-safety bugs, logic flaws, weak configurations, or other classes of issues.

The key finding is the combination of actions. In real-world intrusions, a single vulnerability rarely provides complete control of a well-defended environment. An attacker often has to connect multiple weaknesses to escape isolation, bypass controls, and escalate privileges. Astra reportedly automated precisely this sequence.

Greater Jailbreak Resistance Than GPT-5.6 Sol

These offensive capabilities are accompanied by a reported improvement in safety behavior. Astra allegedly rejected 91.5% of cybersecurity-related jailbreak attempts used in internal evaluations.

Its predecessor, GPT-5.6 Sol, stopped 59% of the same type of test. The difference is 32.5 percentage points.

OpenAI also reports that Astra was less likely to deliberately circumvent restrictions, attack honeypots deployed during testing, or continue offensive operations when the environment had been designed to detect deviations from the controls.

The rejection rate, however, is not an absolute guarantee. A rate of 91.5% means that some attempts considered hostile were not blocked under the test conditions. Moreover, a model with more advanced capabilities can cause greater harm when a control fails.

Risk assessment therefore depends on the interaction between two factors: how difficult it is to induce the model to behave dangerously, and how much damage it can cause once its protections have been bypassed.

Limited Distribution and Access Through Daybreak Blue

OpenAI considers additional safeguards necessary before deployment. Astra’s full cybersecurity capabilities will initially be available only to a group of testers, with a possible broader rollout later through the Daybreak Blue program.

No date has been announced for general availability. The company has also not specified the admission criteria for the program or the technical limits imposed on authorized users.

The stated controls include targeted jailbreak testing, monitoring attempts to evade restrictions, the use of honeypots, and evaluations in controlled environments. OpenAI is also considering delaying deployment when the safeguards do not provide sufficient evidence of safe behavior.

The primary mitigation is therefore a staged release, not a patch or update that users can install. OpenAI maintains that these controls must accompany the model throughout its entire lifecycle, from training and evaluation through deployment.

Meanwhile, nearly 130 technology and cybersecurity companies have reportedly backed an OpenAI-led initiative to strengthen cyber defenses. No further details have been provided about the contributions of individual organizations.

The Risk to Defenders, Companies, and Researchers

A system capable of automating exploitation could help defensive teams validate patches, applications, and configurations more quickly. The same capability could also increase the speed and scale of offensive operations.

For companies, the most immediate consequence could be a reduction in the time available to remediate a vulnerability. If a model can rapidly produce exploits from public information, the window between disclosure and exploitation may shrink.

The ability to find zero-days introduces an additional risk: defenders may not yet have signatures, updates, or indicators of compromise available. Under these conditions, segmentation, least privilege, behavioral monitoring, and detection of anomalous activity between the browser and operating system become even more important.

At present, there are no public technical indicators associated with Astra’s tests. No hashes, domains, commands, CVEs, or network patterns are available for defenders to investigate.

The “Critical” classification remains an internal assessment by OpenAI, supported by results that have not been publicly verified. It nevertheless illustrates the threshold AI systems are beginning to reach: no longer merely assistants for analysts and developers, but potential autonomous operators capable of working across an entire compromise chain.