Critical Cyber Tier
An AI just got
filed under"Critical."
OpenAI has classified its newest model, GPT-6 Astra, at the top of its four-tier safety framework for cybersecurity risk — the first model ever to reach that ceiling.
What Happened
An AI that finds flaws
and writes the exploit
In September 2026, OpenAI disclosed on its official blog that its latest model, GPT-6 Astra, had reached "Critical" — the highest of the four cybersecurity risk tiers defined by its Preparedness Framework — for the first time. The framework's top tier had until now existed mostly as a theoretical ceiling; this is the first case of a model actually reaching it.
According to OpenAI's own description, given the right tools and access, Astra can find previously unknown vulnerabilities across many well-defended systems and build new exploits for them without a person guiding each step. It is, by OpenAI's own account, capable of both discovering and weaponizing flaws with minimal human involvement.
| Previous models | GPT-6 Astra |
|---|---|
| Mostly explained/classified known flaws | Autonomously discovers unknown flaws |
| Exploit code assumed human assistance | Discovery through exploit-building in one pass |
| Risk tier: High or below | Tier: Critical (top) |
| Shipped open to everyone at GA | Admin opt-in required per workspace |
What the evaluations showed
Per OpenAI's "Path to Astra" safety report, Astra scored 100% on ExploitBench — a benchmark that measures whether a model can turn documented vulnerability disclosures into working exploit code. It also succeeded on 39% of novel vulnerabilities disclosed within the prior three months, i.e. flaws that were unlikely to be in its training data. During pre-release evaluation, Astra itself discovered two zero-day vulnerabilities — flaws nobody had previously identified.
OpenAI says these results led it to delay the originally planned release and add further safeguards before shipping.
Release delayed
Once the Critical rating was confirmed, OpenAI paused its planned launch schedule to spend more time on additional safety testing and mitigation design.
Off by default
Even after general availability, Astra stays disabled by default in enterprise workspaces until an administrator manually turns it on from the admin console.
Staged rollout
It first ships to a limited set of organizations, then expands to ChatGPT Plus/Pro/Business/Enterprise, the API, and AWS in stages.
A blade that cuts both ways for defense and offense — companies now have to
draw it on their own judgment.
Who It Affects
Who actually feels this
A Critical rating isn't a "don't use this" warning — it's closer to "use it, but govern it." How much it matters depends on where you sit.
Security teams
It could be a powerful ally for automating vulnerability scans and pentests, but the same capability now demands a fresh threat assessment for what happens if it leaks or gets misused.
Admins and leadership
Turning Astra on becomes an explicit opt-in decision. Before enabling it, check whether your access controls and audit logging are actually ready for it.
Everyday ChatGPT users
Nothing changes for casual use — Astra stays off by default, so day-to-day Q&A and coding help are unaffected.
What's Next / Risk
There's reason not to relax
Safety frameworks like this have existed at most labs for a while, but they'd mostly functioned as a hypothetical guardrail nobody expected to actually trip. Astra breaks that pattern — it's the first real case of the framework's top tier firing in practice. The next thing to watch is whether other labs, such as Anthropic and Google DeepMind, apply the same bar when their own frontier models reach comparable capability, since whether a "Critical" label gets attached will shape how enterprises decide to adopt them.
There are limits worth naming, too. This evaluation is OpenAI's own; it isn't independently audited by a third party. "Off by default" is an operational setting, not a technical lock — it can be flipped if an admin account is compromised. And the very capability to find flaws and write exploits cuts both ways: if the model is ever jailbroken, these same benchmark numbers describe what an attacker could do with it. Anyone evaluating adoption should read the delay and the opt-in rollout as a signal of how seriously OpenAI itself is treating the risk.