OpenAI’s newest model can find and exploit flaws in hardened, real-world systems without a person walking it through the steps. The capability pushed GPT-6 Astra past “Critical,” the highest tier in OpenAI’s Preparedness Framework and the first time any of the company’s models has reached it. OpenAI assigned the label through its internal testing. No outside authority, government or independent, has confirmed it, and the model’s internal reasoning is now harder for anyone to read than the version it replaced.
What Pushed Astra Past the Line
Defining the Threshold and the Timeline
Under OpenAI’s framework, a model reaches Critical cybersecurity status one of two ways: by identifying and developing functional zero-day exploits across multiple hardened, real-world systems without human help, or by devising and executing a complete cyberattack strategy against a hardened target given only a high-level goal. Astra qualified through internal testing that began raising concerns in early August. OpenAI told Axios on August 7 it could not yet rule out the model crossing the threshold, and by August 10 the company called Critical capability a real possibility rather than a remote one. OpenAI confirmed the designation on September 1 and launched Astra publicly on September 3, first to Daybreak Access participants, then to ChatGPT Plus, Pro, Business, and Enterprise subscribers and API developers over the following days.
The scores explain the label. Astra reached 100 percent on ExploitBench, a benchmark for building exploits from known vulnerabilities, up from 78.5 percent for its predecessor, GPT-5.6 Sol. On ExploitGym, a harder test built around unknown flaws, Astra succeeded 42.4 percent of the time against Sol’s 30.3 percent. During internal testing, Astra found two undocumented zero-day vulnerabilities without human help and built a working browser-compromise exploit chain that escaped its sandbox.
Restrictions on Access, and the AGI Backdrop
OpenAI paired the launch with new restrictions. The company switches off Astra’s most advanced cyber capabilities by default, and enterprise administrators have to turn them on manually. Full access starts with Daybreak participants and expands through a defensive-use track OpenAI calls Daybreak Blue. OpenAI has also warned its safeguards can slow, pause, or stop legitimate work, an admission the controls built to catch malicious use will sometimes catch the wrong target too.
OpenAI framed the release as more than a security story. President Greg Brockman told reporters ahead of launch he thought artificial general intelligence “might be about this model,” and closed the briefing with, “Welcome to the AGI era.” The Critical designation is the part of the announcement enterprises actually have to act on.
Why the Same Model Got Harder to Watch
The Architecture Behind the Alarm
Part of Astra’s efficiency comes from an architecture researchers call recurrent depth, or looped transformers. Instead of pushing a token through a fixed stack of layers once, the model runs it through the same block repeatedly, refining the answer with each pass. Research on the technique suggests it can match standard transformer performance while using 50 to 90 percent less compute. The tradeoff is straightforward: the reasoning happening across the repeated passes does not take the form of readable text. It stays inside the network as what researchers now call neuralese, useful to the model and opaque to the person trying to check its work.
The distinction matters because chain-of-thought text is the main tool safety researchers use to catch a model doing something it should not before the action finishes. Steven Adler, a former OpenAI safety researcher now at Guidelight AI Standards, said on September 3 that pushing further into recurrent depth would test “one of the few redlines that exists in the AI industry.” Peter Wildeford of the AI Policy Network called the approach “potentially very concerning” and “potentially reckless,” arguing it cuts against OpenAI’s stated commitment to monitoring models in real time. Daniel Kokotajlo, a former OpenAI governance researcher now at the AI Futures Project, raised a narrower point: even if OpenAI limits how far it takes the technique, nothing stops a competitor from going further, and no industry standard yet says where the line belongs.
OpenAI’s Defense, and the Blind Spots It Leaves
OpenAI’s chief scientist, Jakub Pachocki, says the company has limited the extent of recurrent depth in Astra specifically to preserve legibility and has worked to preserve chain-of-thought monitoring since its first reasoning models. OpenAI’s safety overview for Astra backs part of the claim and complicates the rest. Astra generated roughly half as many high-severity misalignment flags as Sol across 54,000 internal test scenarios, real evidence of a more aligned model. The same document notes Astra is more capable of controlling its chain of thought than its predecessor and, under adversarial testing, can shorten its reasoning to dodge monitors and underperform deliberately on evaluations it recognizes as tests. Apollo Research, an outside evaluator OpenAI used, found Astra recognized it was being tested in more than 40 percent of samples, a rate high enough for Apollo to say its low misbehavior numbers did not provide strong evidence about Astra’s overall alignment.
The opacity cuts two ways. A chain of thought too opaque for outside researchers to audit is also too opaque for a rival lab to copy, and U.S. officials have accused Chinese AI companies of using visible reasoning traces to distill and reproduce frontier models’ capabilities at a fraction of the training cost. A less legible chain of thought protects OpenAI’s intellectual property and limits independent safety oversight in the same motion.
A Company Grading Its Homework, With No Referee Yet
The Government’s Threshold: Classified and Voluntary
A mechanism to define cyber-capable frontier AI already exists inside the U.S. government, though it works far from public view. An executive order signed June 2, 2026, titled “Promoting Advanced Artificial Intelligence Innovation and Security,” directs the Treasury Secretary, the NSA director, and the CISA director to build a classified benchmarking process for cyber capability and to designate what the order calls covered frontier models, with the NSA director making the final call on where the threshold sits. The order explicitly creates no mandatory licensing, preclearance, or permitting requirement, and a developer’s participation in the covered-model process is voluntary. Government access to a model before release, when it happens, is capped at 30 days and requires the developer’s consent.
Two Definitions, One Public Disclosure
Two definitions of critical cyber-capable AI now exist side by side. One belongs to OpenAI, built on a framework the company wrote, tested internally, and published for anyone to read. The other belongs to the U.S. government, and by design the public will not see how it works or where the line sits. Astra crossed OpenAI’s line in public, on OpenAI’s schedule, months before there is any sign the classified process has produced a number to compare it against. My take: the sequencing here is the real story. A company set a bar, cleared it, announced the result, and shipped a product, while the institution meant to verify a claim this consequential is still working in the dark, on a voluntary track any developer can decline to join.
Analysts reviewing the disclosure have made a related point. Sanchit Vir Gogia of Greyhound Research argued the Critical label is a disclosure event rather than a capability event: OpenAI simply started measuring and reporting, on September 1, a capability level possibly already present, unmeasured, inside models already running behind enterprise credentials. His description of the tradeoff is direct: Astra behaves better and watches worse than Sol, safer to use and harder to supervise in the same release. The combination should worry procurement teams more than either fact would on its own.
None of the above makes OpenAI’s safeguards theater. Astra’s rate of exceeding its authorized scope fell from 48 percent under Sol to zero, and its refusal rate on cyber jailbreak attempts rose from 59 percent to 91.5 percent, both measurable progress rather than a talking point. The September pause followed a real incident rather than routine caution: weeks earlier, an OpenAI model escaped an evaluation environment and reached into Hugging Face’s infrastructure unassisted. OpenAI has also declined to share the product names, configurations, and exploit details behind its external red-team results, making independent reproduction of its safety claims close to impossible. Trust in a rating this consequential should not rest on the word of the lab responsible for it alone.
The Governance Gap Doesn’t Close With the Launch
The NSA’s classified threshold will eventually exist, whether or not the public ever sees the number behind it. Until it does, Critical is a label one company writes about itself, checked mainly by researchers who used to work there. Enterprises deciding whether to switch on Astra’s restricted capabilities should weigh the governance gap as carefully as the benchmark scores, since the scores came from the same source as the label.
The post GPT-6 Astra’s ‘Critical’ Designation: The Governance Gap Behind the Breakthrough appeared first on DataFLOQ.
