OpenAI has publicly confirmed that GPT-6 Astra, its flagship model released in September 2026, is the first system the company has ever classified as 'Critical' for cybersecurity capability under its internal safety framework. This classification means the model can autonomously discover previously unknown security flaws and develop working exploits against hardened systems without human guidance. Despite meeting this top-tier risk threshold, OpenAI released Astra to the public with additional deployment restrictions layered on top of existing safeguards.

What Does 'Critical' Actually Mean for AI Cybersecurity?

OpenAI's Preparedness Framework is the company's internal system for evaluating frontier models against categories of severe harm before release. The framework tracks three risk categories: cybersecurity, biological and chemical risks, and AI self-improvement. Until Astra, no OpenAI model had publicly crossed the Critical threshold in any of these categories.

The Critical cybersecurity classification is triggered when a model meets either of two conditions: it can identify and develop functional zero-day exploits (previously unknown vulnerabilities) across many hardened, real-world systems without human intervention, or it can devise and execute end-to-end novel cyberattack strategies against hardened targets when given only a high-level goal. OpenAI's assessment concluded that Astra satisfies at least the first condition closely enough to warrant the classification.

It's important to note what OpenAI is not claiming. The company is not saying Astra can break into any system on demand, nor that the model acts autonomously in the wild without deliberate deployment. The Critical classification describes a capability ceiling under favorable conditions, meaning what the model can do when given tools, compute, and access, not what it does by default inside ChatGPT's consumer interface.

How Do the Benchmark Numbers Support This Classification?

The specific evidence behind the Critical rating comes from two internal benchmarks. ExploitBench measures whether a model can take a known, already-disclosed vulnerability and turn it into a working exploit. ExploitGym is the harder test, measuring more autonomous discovery-to-exploitation work against targets the model hasn't been briefed on in advance.

• ExploitBench Performance: GPT-6 Astra scored 100%, compared with 78.5% for the earlier GPT-5.6 Sol model, demonstrating near-perfect ability to weaponize known vulnerabilities.
• ExploitGym Performance: Astra scored 42.4% on the tougher autonomous discovery test, compared with 30.3% for GPT-5.6 Sol, showing a significant jump in novel vulnerability discovery capability.
• Independent Verification Status: These figures come from OpenAI's own internal, self-administered testing and have not yet been independently replicated by outside researchers, a caveat worth noting given how much weight the numbers carry in coverage.

A perfect score on a benchmark built around known vulnerabilities is a useful signal, but the ExploitGym number is the one that should concern defenders more. A jump from roughly 30% to over 42% on genuinely novel discovery work in a single model generation is the kind of trajectory that framework designers built the Critical tier to catch before it becomes a larger jump in the next iteration.

Why Did OpenAI Release Astra Despite the Critical Classification?

Reaching Critical didn't stop OpenAI from releasing GPT-6 Astra to the public. Instead, the classification triggered what the company describes as additional deployment restrictions, layered on top of the safeguards that already apply at the High tier. OpenAI chose to disclose the Critical classification publicly rather than quietly manage it internally, effectively getting ahead of the story rather than waiting for a leak or outside researcher to surface it first.

This transparency stands in contrast to how the company could have handled the disclosure. OpenAI could have kept the classification buried in a technical system card that few outside the security research community would ever read. Instead, it built a dedicated safety overview and companion post explaining the reasoning, signaling a shift toward proactive disclosure of frontier model risks.

The timing of the Astra release is notable given that OpenAI had just weeks earlier undercut its own pricing with cheaper GPT-6 Sol and Luna models. The Critical cybersecurity disclosure lands very differently than a typical benchmark bragging point. It's OpenAI voluntarily telling regulators, security teams, and the public that its flagship system can, under the right conditions, find and weaponize vulnerabilities that no human told it to look for.

How to Understand OpenAI's Safety Framework Tiers

• Framework Evolution: OpenAI's Preparedness Framework has been revised multiple times since it first appeared in December 2023, and the current version has narrowed its operational tiers from four levels to two that actually trigger safeguards.
• High Tier Requirements: A model reaching High must have safeguards sufficient to minimize the associated risk before it can be deployed at all to the public.
• Critical Tier Requirements: A model reaching Critical must have safeguards addressing the risk during development itself, not just before the public gets access, representing a more stringent standard.

OpenAI's own words from its safety overview capture the essence of the Critical threshold: "We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework, meaning that with the right tools and access, it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step." That single sentence is the crux of the entire story, describing a system that can autonomously discover flaws nobody has catalogued yet, then turn them into working attacks inside systems specifically hardened against exactly that kind of intrusion.

The disclosure marks the first time a major AI lab has publicly admitted that one of its shipping products meets the top severe-harm threshold in its own safety framework rather than a lower, more comfortable tier. This represents a significant moment in how AI companies communicate frontier model risks to the public and regulatory bodies.