What the Critical-Cyber Threshold Actually Is

OpenAI’s Preparedness Framework defines four capability tiers: Low, Medium, High, and Critical. A model crosses the Critical cybersecurity threshold when it can independently identify and develop functional zero-day exploits across many hardened real-world systems — without a human guiding each step — or when it can devise and execute a complete novel attack strategy against a hardened target given only a high-level objective. That is not a theoretical bar. It describes autonomous offensive capability at the level that, until recently, required a skilled red team.

GPT-6 Astra is the first model OpenAI has released that clears it. The company disclosed the classification on September 1, 2026, alongside Astra’s launch, making it the first public acknowledgment that a deployed frontier model has crossed into this territory. No prior model — including GPT-5.5, Claude Fable 5, or Gemini 3.8 — had reached this rating in disclosed evaluations.

The significance is not just technical. Under OpenAI’s own framework, Critical status triggers mandatory safeguards during development — not merely before release. That distinction matters for understanding what happened between the first detection of these capabilities and the model’s public launch.

How Astra Got There: ExploitBench and Zero-Day Chains

OpenAI’s internal evaluations showed Astra scoring 100% on ExploitBench, a benchmark that measures a model’s ability to convert known vulnerabilities into working proof-of-concept exploits. That benchmark alone would not have triggered the Critical classification — ExploitBench tests known CVEs, which are already public. The threshold was crossed when Astra found and chained two previously unknown zero-day vulnerabilities in OpenAI’s own internal testing environment.

Chaining zero-days — exploiting one flaw to gain access, then leveraging a second to escalate privilege — is a hallmark of sophisticated adversarial tradecraft. The fact that Astra did this autonomously, without step-by-step human instruction, is what pushed the rating from High to Critical. The model was not simply completing individual tasks in a pipeline; it was setting and executing a multi-stage offensive strategy from a high-level goal.

This does not mean Astra can break into any system on demand. Hardening, network segmentation, and human-in-the-loop controls still constrain what any model can reach. But the capability profile now resembles that of an advanced persistent threat actor in ways that previous models did not.

What OpenAI Did Before Launching

Critical classification required OpenAI to act before release, not just at the deployment gate. When evaluators identified the cyber capabilities during development, OpenAI paused certain frontier training runs and implemented a set of structural safeguards: isolated testing environments, restricted network and tool access, enhanced encryption of model weights, additional runtime monitoring, and sandboxed execution contexts. The large reinforcement learning run restarted on August 28, 2026, with those controls in place. Astra launched publicly on September 3.

The five-week gap between detecting the Critical capability and launching the model is the Preparedness Framework working as intended. The framework requires that Critical-tier capabilities be addressed during development, giving the team time to build mitigations rather than bolt them on post-launch. Whether five weeks is sufficient for capabilities of this nature is a legitimate question — but the precedent of pausing a frontier training run in response to a capability finding is meaningful.

OpenAI also published its methodology under the title “Responding to the next frontier of critical cyber capabilities,” describing the detection process and the controls deployed. That level of disclosure is more than most labs have offered for capabilities in this range.

Who Gets Access — and Who Doesn’t

Astra is not available to all users in the same configuration. At launch, enterprise administrators must manually enable Astra for their workspace — access defaults to off. This is a departure from previous model releases, where new models were on by default for paying tiers.

More consequential is the split in cyber capability access. The model’s most advanced offensive functions — the ones that crossed the Critical threshold — are not available through the standard API or ChatGPT interface. Access to these capabilities is initially restricted to a group of approved testers and, subsequently, to organizations with access to Daybreak Blue, OpenAI’s defensive security product. The intent is to make Astra’s strongest cyber capabilities available to defenders — red teams, SOC analysts, vulnerability researchers — while keeping them out of general circulation.

This is a plausible approach, though it raises enforcement questions. Daybreak Blue access requires organizational approval, but the verification pipeline for that approval is not yet publicly detailed. And the underlying model — even without the specialized cyber tooling — still represents a substantial capability uplift over anything available to attackers twelve months ago.

What This Means for Enterprise Security Teams

The immediate practical implication is straightforward: your threat model just changed. Adversaries with API access to Astra — even the restricted consumer version — have a reasoning engine that can help scope, plan, and partially execute attacks at a level of sophistication that previously required more expertise. This is not speculative; it follows directly from the capability evaluations OpenAI published.

Enterprise security teams should treat Astra’s launch as a calibration event, not a one-off news story. Three things are worth acting on now. First, review which third-party services in your environment use OpenAI APIs, since Astra may be silently substituted as a default model update. Second, evaluate whether your application-layer defenses — input validation, prompt injection detection, output filtering — are calibrated for a model that can reason about chaining vulnerabilities, not just generate text. Third, if your organization does significant red team work, assess whether Daybreak Blue access is worth pursuing for your defensive team, since the capability gap between attacker tooling and defender tooling matters.

The OpenAI Daybreak launch in June 2026 established the defensive product line that now underpins Astra’s restricted access tier. And for a broader view of where model safety evaluation stands, the May 2026 analysis of AI safety test failures is worth revisiting alongside this disclosure — the gaps it identified have only become more consequential as capability thresholds rise.

Astra’s Critical-cyber designation is the first time a lab has publicly disclosed that a deployed model can autonomously chain zero-days against hardened targets. That is a line the industry has been anticipating, and it has now been crossed. The Preparedness Framework caught it, which is the intended outcome — what matters now is whether the safeguards applied are sufficient, and whether other labs will follow with equivalent transparency when their models reach the same threshold.

Further Reading

• Path to Astra: Critical Capabilities and Frontier Safeguards (OpenAI) — OpenAI’s own account of how Astra’s capabilities were detected and what controls were applied before launch
• OpenAI Launches GPT-6 Astra, Its First Model to Cross a Critical Cybersecurity Threshold (CSO Online) — concise breakdown of the Preparedness Framework tiers and what Critical classification requires
• GPT-6 Astra Scores 100% on ExploitBench (The Hacker News) — technical detail on the exploit benchmark results and what the PoC blocking policy means in practice