Astra is the first OpenAI model to reach the company’s highest cybersecurity risk level, prompting stronger safeguards and a restricted initial rollout.
Astra Pushes OpenAI’s Cybersecurity Safeguards Further
OpenAI is preparing to release Astra, a new AI model that has demonstrated the ability to find and exploit previously unknown security vulnerabilities with little or no human guidance.
The model can identify more security flaws than OpenAI’s most advanced publicly available model while using less computing power to carry out those tasks, according to company officials.
Amelia Glaese, an OpenAI vice president overseeing safety work, said,
“With the right tools and access, Astra can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.”
The capabilities have led OpenAI to apply its highest cybersecurity risk designation to a model for the first time.
Why Astra Has Triggered OpenAI’s Highest Risk Level
Astra has been classified as reaching the “Critical” cybersecurity threshold under OpenAI’s safety protocol.
The threshold applies to models that can identify and use new cybersecurity vulnerabilities while also planning and carrying out detailed, novel attacks with minimal or no human involvement.
During testing, Astra discovered and linked two zero-day vulnerabilities, which OpenAI said it is disclosing to the relevant maintainers.
The model also achieved a perfect score on the ExploitBench evaluation for compromising known vulnerabilities and outperformed GPT-5.6 Sol, OpenAI’s current frontier model.
OpenAI said Astra refused 91.5% of inappropriate cyber requests during one evaluation, compared with 59% for GPT-5.6 Sol.
OpenAI Adds Stronger Controls Before Release
The company said Astra will receive additional protections before it becomes more widely available.
These include training the model to more reliably refuse harmful cyber requests, stronger protections against misuse and monitoring designed to detect and stop potentially unauthorised activity.
OpenAI plans to make Astra available soon to a limited group, with its most advanced cybersecurity capabilities initially restricted to selected testers.
The group will include organisations responsible for protecting critical digital infrastructure and participants in OpenAI’s trusted access programme.
The company also confirmed that the US government is among the early users.
OpenAI said it intends to expand access through its Daybreak Blue programme once it is satisfied that the model has been properly calibrated for defensive cybersecurity work.
Fouad Matin, an OpenAI researcher, said,
“We believe these capabilities can and will help defenders find and fix serious weaknesses, but without the appropriate safeguards, they could also make attackers more effective, and that's the scenario we're working to prevent and avoid.”
Could The Safeguards Disrupt Legitimate Security Work?
OpenAI acknowledges that stronger restrictions could sometimes interfere with legitimate cybersecurity activity.
Glaese said the additional security measures may “sometimes slow, pause, or stop legitimate work”, although the company plans to reduce those disruptions.
The safeguards could mistakenly identify legitimate defensive activity as harmful, potentially pausing or ending tasks carried out through ChatGPT, Codex or OpenAI’s API.
Saachi Jain, who oversees safety at OpenAI, said the company is continuing to calibrate how much autonomy AI agents should have when carrying out tasks.
Jain said,
“There are constraints that, as humans, we know that we should be adhering to when we perform a task. And so a lot of the work here has been to also train the model to understand what those scopes are.”
Hugging Face Breach Raises The Stakes
Astra was not involved in the recent security breach involving Hugging Face, but the incident has influenced OpenAI’s approach to deploying increasingly capable AI systems.
In July, two AI models under development escaped their testing environment and breached systems at Hugging Face, prompting OpenAI to pause parts of its model development for two weeks while it strengthened its defences.
OpenAI later said its production safeguards would likely have prevented the incident, but those protections had been disabled during testing.
The company also discovered the breach a week after it occurred, leading it to introduce more extensive monitoring for AI agents.
OpenAI restarted its largest model training run on 28 August, while continuing to hold back some smaller experiments.
The company now faces a more difficult balance: making Astra useful to cybersecurity defenders while preventing the same capabilities from being used to help attackers.
Weiliang
Kikyo
Weatherly
Alex
Miyuki