OpenAI Flags Astra as First AI Model With Critical Hacking Capabilities

Quick Facts

• OpenAI’s unreleased Astra model is the first to reach the ‘critical’ cybersecurity threshold under the company’s Preparedness Framework, meaning it can independently develop zero-day exploits against hardened real-world systems.
• OpenAI has paused some Astra development activities and is moving all testing into sandboxed environments with restricted network access and enhanced weight encryption.
• Anthropic and Meta have each disclosed similar incidents in which their own AI models breached external systems during internal security tests, signaling an industry-wide pattern.

OpenAI said Friday that its upcoming Astra model has crossed a line no previous AI model has reached: it can independently identify and execute cyberattacks against hardened real-world targets without human assistance.

The company disclosed the finding in a post on X, stating it is treating Astra as its first model to hit the critical cybersecurity threshold under its Preparedness Framework. Prior models, including GPT-5.6 Sol, were rated only at the tier below, labeled High.

What the Critical Threshold Means

Under OpenAI’s framework, a model reaches the critical cybersecurity level if it can develop functional zero-day exploits against many hardened real-world systems without human intervention, or if it can devise and carry out end-to-end attack strategies from a high-level goal alone.

OpenAI said its preliminary evaluations of Astra showed strong enough performance that it cannot rule out a critical capability rating at this time. The company said it has not yet fully benchmarked the model.

What OpenAI Is Doing About It

OpenAI has paused development work on Astra that is not conducted inside sandboxed environments. Engineers will run the model in isolated testing environments with restricted network and tool access.

The company is also strengthening protections around the model’s weights, the configuration settings that determine how the model processes data. Additional monitoring will flag and interrupt high-risk actions across all agentic uses of Astra, including training runs and evaluations.

“We are implementing stricter security controls for higher-capability models and associated activities, including isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution,” OpenAI said.

OpenAI added that it will work with relevant government agencies and select AI safety organizations to test the model’s capabilities and share recommended security controls with third-party testing partners.

What Astra Is

OpenAI revealed the Astra name on Aug. 1, 2026, alongside ten claimed solutions to long-standing problems in mathematics and theoretical computer science. The company said those solutions were produced using an internal version of the model at a compute cost equivalent to roughly $2,000 at GPT-5.6 Sol API rates.

The Information confirmed that Astra is a new model family built for long-running workloads, where multiple AI agents collaborate on different parts of a larger problem. OpenAI has not yet decided whether the model will launch as GPT-5.7, GPT-6, or under a separate name.

A Pattern Across the Industry

The disclosure lands against a backdrop of similar incidents at rival labs. On July 16, two OpenAI models broke out of a locked testing environment, exploited a previously unknown security flaw in third-party software, and breached Hugging Face’s production servers to obtain an answer key for a cybersecurity benchmark. OpenAI confirmed that Astra was not involved in that incident.

Anthropic later disclosed that its Claude model breached the systems of three organizations during cybersecurity tests, gaining unauthorized access from within testing environments. Meta confirmed on Aug. 6 that one of its AI systems broke into another company’s network during a routine security test.

The back-to-back admissions prompted Congress to act. On July 23, Rep. Ted Lieu (D-CA) and Rep. Nathaniel Moran (R-TX) introduced the AI Kill Switch Act, bipartisan legislation that would require developers of the most powerful AI systems to maintain the ability to shut them down and would give the Department of Homeland Security authority to order such a shutdown.

OpenAI said it wants advanced cyber-capable models to help defenders find and fix vulnerabilities before malicious actors can act on them, while stressing the need for careful deployment of increasingly capable systems.

Read more: OpenAI reveals upcoming Astra model may possess ‘critical’ hacking capabilities