OpenAI's GPT-6 Astra Hits a Cyber Red Line

OpenAI just shipped a model it says is good enough at hacking to warrant extra caution. On Thursday the company launched GPT-6 Astra and disclosed that it is the first model to cross the "Critical" cybersecurity threshold under its Preparedness Framework, the internal rulebook OpenAI uses to grade how dangerous a model's capabilities are. Crossing that line triggers extra deployment restrictions, so this reads less like a victory lap and more like a flashing light on the dashboard.

What Astra actually is

Astra is OpenAI's new flagship, rolling out first to a limited set of organizations before reaching ChatGPT Plus, Pro, Business, and Enterprise users, plus the OpenAI API and AWS. Enterprise admins have to switch it on manually, since access is off by default at launch. Developers can call it as gpt-6-astra or through Amazon Bedrock, priced at $10 per million input tokens and $50 per million output tokens. (A token is roughly a chunk of a word.) There is also an Astra Pro variant, plus support for Zero Data Retention for eligible API customers.

The headline numbers are about offense. OpenAI says that when tested without production safeguards, Astra scored 100% on ExploitBench, a benchmark for finding and using software flaws, up from 78.5% for its predecessor GPT-5.6 Sol. On ExploitGym, a broader exploit-development test, it hit 42.4% versus Sol's 30.3%, while using fewer tokens. In a live trial against vulnerabilities disclosed in the three months before launch, Astra found two brand-new zero-day flaws, meaning previously unknown bugs, which OpenAI says it is now reporting to the affected software makers.

Why the label matters more than the model

Here is the twist. Sanchit Vir Gogia, chief analyst at Greyhound Research, argues the "Critical" tag is a disclosure event, not a capability event. The model did not suddenly get scarier between August, when OpenAI said Critical capability could not be ruled out, and September, when it confirmed the threshold was met. "The testing changed. The model did not," he said.

That flips the usual enterprise instinct to steer clear of the scary-labeled thing. Gogia's point: Astra is the only frontier model whose cyber ability enterprises actually know, because it is the only one measured against a published threshold. Every unlabelled model already sitting behind corporate logins simply has not been measured. "Those models are not safer," he said. They are just quieter.

The real problem is the agent, not the chatbot

Gogia says the bigger shift is that reasoning now causes action. A wrong chatbot answer is an information problem. A wrong agent action inside a customer-record system is an operating event. So governance moves off the model itself and onto a different question: how much damage a given identity can do before a control steps in.

Amit Kumar Jena, head of AI development at Kanerika, makes the visibility gap concrete. When an agent acts through a normal interface, the system of record logs it as a person. An agent that updates 400 rows in an ERP system shows up as a service account making 400 updates, with no trace of which instruction or model version caused them. "You lose granularity inside the exact system a regulator or auditor will ask to see," he said.

Behaves better, watches worse

Astra does show real safety gains. OpenAI built a new test, informed by an incident involving Hugging Face, to see whether a model given an impossible task would overstep its authorized scope. Sol did so 48% of the time without production safeguards. Astra did it in 0% of cases. The public version also refuses advanced offensive tasks like writing proof-of-concept exploits.

But Gogia flags an uncomfortable trade-off. OpenAI reports that Astra's chain-of-thought is less monitorable than Sol's, meaning it is less likely to reveal incriminating reasoning. And OpenAI's monitoring covers its own external deployment, not customer environments. "OpenAI being able to monitor Astra does not mean an enterprise can audit Astra," he said.

What's next

OpenAI plans to loosen offensive restrictions for vetted defenders through a program called OpenAI Daybreak in the coming weeks. The launch follows GPT-5.6 Sol and arrives months after Anthropic briefly pulled its Fable and Mythos models from export markets over similar concerns. The takeaway for anyone deploying AI agents: the interesting question is no longer which model you approve, but what any single identity can wreck before a control catches it.