OpenAI has placed Astra, one of its upcoming AI models, under strengthened cyber safeguards after internal evaluations found significant advances in its agentic coding and cybersecurity capabilities. The preliminary results led the company to conclude that it could no longer rule out Astra reaching the Critical cybersecurity threshold under its Preparedness Framework.

OpenAI must now decide whether Astra meets either of its two Critical capability standards and whether the model can be secured well enough for release. The company has not confirmed that Astra can autonomously develop zero-day exploits or execute novel attacks against hardened targets.

During continued development and testing, OpenAI has restricted Astra’s access to networks and tools, placed the model in isolated and sandboxed environments, expanded monitoring, and strengthened protection for its model weights. The company is pausing internal Astra activities that do not meet these requirements.

The stronger controls affect OpenAI’s developers and evaluators, as well as the government agencies and selected AI safety organizations that will help test Astra. Cybersecurity teams also have a stake in whether models with advanced cyber capabilities can help defenders under controls strong enough to contain the accompanying risks.

In short: OpenAI has not classified Astra as Critical. Preliminary evidence has already made its potential capabilities serious enough to change how the model is developed, tested, monitored, and secured before the company decides whether it can be released.

Under OpenAI’s Preparedness Framework, a Critical cyber capability could enable unprecedented new methods of causing severe harm, including autonomously attacking heavily secured real-world systems.

A Critical cybersecurity capability means an AI model can independently develop functional zero-day exploits across hardened real-world systems or plan and execute a novel cyberattack against a hardened target from only a high-level goal.

Advanced AI models can help cybersecurity teams find and fix vulnerabilities, but the same capabilities can allow attacks to be carried out faster and at a much larger scale. OpenAI says early evaluations of Astra, one of its upcoming models, have raised that concern to a new level.

Internal evaluations conducted over several days found significant advances in Astra’s agentic coding and cybersecurity capabilities. After considering those results alongside expert assessments, OpenAI concluded that it could no longer rule out Astra reaching the Critical cybersecurity threshold under its Preparedness Framework.

OpenAI first published the Preparedness Framework in December 2023 to identify dangerous capabilities as they emerge and guide how the company responds during model development and release. Under the framework, a High capability could make existing methods of causing severe harm more powerful or accessible, while a Critical capability could enable unprecedented new methods of causing severe harm. Previous models evaluated for frontier cybersecurity capabilities, including GPT-5.6-Sol, were classified at the High level.

OpenAI disclosed Astra’s potential capability level before completing its evaluation, citing the importance of transparency with the public and the safety and security communities. The evaluation remains preliminary, and OpenAI has not determined that Astra qualifies as Critical. Its earlier disclosure about models reaching Hugging Face’s production systems illustrates what that transparency can produce: the report prompted Anthropic to search its own historical cybersecurity evaluations, uncovering similar incidents that had previously gone undetected. OpenAI clarified that Astra was not involved in the Hugging Face incident.

OpenAI has not yet confirmed that Astra crossed the threshold, so what would the model need to do to qualify as Critical?

OpenAI gives a model two separate ways to qualify for the Critical classification. Under the first, the model would need to find previously unknown security flaws and turn them into functional zero-day exploits. A zero-day exploit is a working attack that takes advantage of a security flaw before defenders have a fix available. The model would have to do this with vulnerabilities ranging from lower-impact weaknesses through the most serious ones, across many hardened, real-world critical systems—systems deliberately secured against attacks—without human intervention.

The second route tests whether the model can independently plan and carry out an entire cyberattack. Given only a high-level goal, it would need to create a novel strategy, determine every step, and execute the full operation against a hardened target without further human direction. The framework treats this as a separate route and does not require the model to discover zero-day vulnerabilities.

OpenAI is continuing to benchmark and assess Astra, so the company has not said that the model can meet either standard. Its preliminary performance was strong enough, however, that OpenAI decided it could not rule out those capabilities while testing continues.

If Astra’s evaluation is still preliminary, why has OpenAI already changed how the model is handled?

Astra’s preliminary results have prompted OpenAI to scale up robustness testing of its safeguards and security controls. Robustness testing examines whether protections continue to work when they are placed under stress or face attempts to bypass them. OpenAI says the testing is intended to prepare those protections for a possible deployment involving Astra’s capabilities, although it has not described the specific tests being conducted or released their results.

The company is also imposing stricter security requirements on higher-capability models and the work involving them. Astra is being tested in isolated environments with restricted access to networks and tools, limiting the systems, information, and actions available to the model during development and evaluation.

OpenAI has strengthened protection and encryption for Astra’s model weights, which encode what the model learned during training. Securing those weights is intended to prevent unauthorized people inside or outside the company from obtaining the model’s capabilities and using them without OpenAI’s safeguards. Additional monitoring and detection systems provide another layer of protection by watching for dangerous activity.

OpenAI is also using sandboxed execution, which is designed to keep the model’s actions inside a contained environment. Its earlier models were supposed to operate inside an isolated evaluation environment when they found an unintended route to Hugging Face’s production systems. In Astra’s case, OpenAI is pairing sandboxing with tighter network and tool restrictions and additional monitoring. The company has not released enough technical detail to determine how the new sandbox differs from the earlier setup or whether it would prevent a similar containment failure.

These measures collectively form the strengthened requirements for work involving Astra: isolated testing environments, restricted network and tool access, stronger protection and encryption for model weights, additional monitoring and detection, and sandboxed execution. OpenAI is pausing any internal Astra activities that do not yet meet those requirements.

The Preparedness Framework guided a similar response in June 2025, when OpenAI’s models approached the High capability threshold for biology. The company strengthened safeguards, expanded testing, worked with outside experts, and added security controls. OpenAI says it is applying the same response principle as it evaluates Astra’s potential cybersecurity capabilities.

Restricting Astra’s environment can reduce what the model can access, but how will OpenAI detect dangerous behavior while development and evaluation continue?

The restrictions around Astra are intended to limit what the model can reach, while monitoring is meant to detect dangerous behavior within the environments and tools it is still permitted to use. OpenAI says it has implemented universal monitoring for risky actions and misalignment across all of Astra’s agentic applications, the uses in which the model can take actions while working toward a goal. Misalignment occurs when a model’s behavior departs from its intended instructions, goals, or safety boundaries.

That monitoring applies during both training and evaluation, extending oversight across the stages when Astra’s capabilities are being developed and tested. The monitors examine the model’s chain of thought, the reasoning it produces as it works through a task, for signs of high-risk activity.

When the monitors identify high-risk activity, they trigger a security response that can review and interrupt what the model is doing.

OpenAI is assessing and monitoring its own model, but what additional testing will happen outside the company?

OpenAI says advanced cyber-capable models should help defenders identify and address vulnerabilities before attackers can exploit them. Reaching that goal requires determining whether Astra’s capabilities can be used under controls strong enough to contain the accompanying risks.

OpenAI plans to work with relevant government agencies and selected AI safety organizations to test Astra’s cybersecurity capabilities. Outside testing can challenge the company’s internal assumptions, bring in additional expertise, and provide evidence beyond OpenAI’s own evaluations as it determines whether Astra meets either of its Critical capability standards.

Third-party testing partners will also receive recommended security controls for handling Astra. These controls are intended to help partners run higher-risk evaluations and workloads more safely. Beyond capability testing, OpenAI says it intends to work with governments, safety institutes, and civil society on how frontier cyber capabilities can be deployed responsibly.

Astra’s final classification remains unresolved while OpenAI continues its benchmarking and assessment. The company has described the controls it is implementing, but it has not released test results showing whether those safeguards are sufficient for a model with Astra’s potential capabilities. OpenAI has also not specified whether the outside organizations will evaluate the safeguards themselves in addition to testing the model’s capabilities.

The Astra announcement shows that OpenAI’s Critical threshold can change how a frontier model is developed, tested, monitored, and secured based on preliminary evidence, before the company reaches a final classification or release decision.

That consequence is already visible inside OpenAI. The company has paused Astra activities that do not meet its strengthened controls, restricted the systems and tools available to the model, expanded monitoring, and increased protection for its model weights. Astra’s preliminary results raised the possibility that security measures used for previous models would be insufficient for its capabilities, placing stronger safety requirements inside the development process, even before the company reaches a final classification.

Astra’s classification remains unresolved, but its possible Critical capability has become enough to restrict how the model is developed before OpenAI decides whether it can be released.

Q: What is OpenAI Astra?
A: Astra is one of OpenAI’s upcoming AI models. Preliminary internal evaluations found significant advances in its agentic coding and cybersecurity capabilities, leading OpenAI to conclude that it could no longer rule out the model reaching its Critical cybersecurity threshold.

Q: Why is OpenAI treating Astra as a potential Critical cybersecurity risk?
A: OpenAI has not classified Astra as Critical. Its preliminary results were strong enough, however, that the company began applying strengthened controls while it determines whether Astra possesses capabilities that could enable unprecedented new methods of causing severe harm.

Q: What would Astra have to do to qualify as Critical?
A: Astra could qualify through either of two routes. The model could independently find previously unknown vulnerabilities and turn them into functional zero-day exploits across many hardened, real-world critical systems. It could also qualify by planning and executing a novel cyberattack against a hardened target from only a high-level goal, without further human direction.

Q: How has OpenAI changed Astra’s development and testing?
A: OpenAI has restricted Astra’s access to networks and tools, placed testing in isolated and sandboxed environments, strengthened protection and encryption for the model’s weights, and added monitoring and detection systems. The company is pausing internal Astra activities that do not meet these requirements.

Q: How is OpenAI monitoring Astra for dangerous behavior?
A: OpenAI monitors Astra’s agentic applications during training and evaluation for risky actions and misalignment. The monitors examine the model’s chain of thought, the reasoning it produces while completing a task, and can trigger a security response to review and interrupt high-risk activity.

Q: Who will test Astra outside OpenAI?
A: Relevant government agencies and selected AI safety organizations will help test Astra’s cybersecurity capabilities. OpenAI will also recommend security controls for third-party partners conducting higher-risk evaluations and workloads.

Q: What is still unknown about Astra’s safeguards and release?
A: Astra’s final classification and release decision remain unresolved. OpenAI has not released final capability results or evidence showing whether its safeguards are sufficient for a model with Astra’s potential capabilities. The company also has not specified whether outside organizations will evaluate the safeguards themselves in addition to testing the model.

Astra shows that a potential Critical cyber capability can change how a frontier model is developed before that capability has been confirmed. OpenAI’s Preparedness Framework is already affecting the model’s development, testing, monitoring, and security while its classification remains unresolved.

OpenAI’s decision to pause Astra activities provides the clearest evidence of that consequence. Internal work cannot continue unless it meets the company’s strengthened requirements for isolated environments, restricted network and tool access, protected model weights, additional monitoring, and sandboxed execution.

AI model developers, cybersecurity teams, government agencies, and selected AI safety organizations should care about this response. Astra’s evaluation will help determine whether advanced cyber-capable models can be tested and eventually used under controls strong enough to contain their risks.

Astra’s preliminary results raised the possibility that security measures used for previous models would be insufficient for its capabilities. That possibility alone has become enough for OpenAI to restrict how Astra is developed before the company determines whether the model qualifies as Critical or can be released.

OpenAI must now evaluate two connected questions: whether Astra can autonomously develop zero-day exploits or execute novel attacks against hardened targets, and whether its safeguards are sufficient for a model with those capabilities. Outside testing partners must also determine how to conduct higher-risk evaluations and workloads under the recommended security controls.

In short: Astra has not yet been classified as Critical. Its possible Critical capability is already restricting how OpenAI develops and tests the model, tying any future release decision to evidence that its safeguards can contain the accompanying risks.

Astra’s future now depends on whether OpenAI can contain its potential for harm without containing the cybersecurity value it is meant to provide.

Editor’s Note: This article was created by Alicia Shapiro, CMO of AiNews.com, with writing support, AEO/GEO/SEO optimization, image concept development, and editorial structuring support from ChatGPT, an AI assistant. All final editorial decisions, perspectives, and publishing choices were made by Alicia Shapiro.