OpenAI Rates GPT-6 Astra 'Critical' for Cybersecurity

OpenAI shipped GPT-6 Astra on September 3, 2026 and rated it "Critical" for cybersecurity under its Preparedness Framework — the first model it has ever placed in that tier. Access ships off by default.

For developers, the rating is not a press-release detail. It changes how you get the model, what it will refuse, and what your logs will show afterward.

What the cyber evals measured

On ExploitBench, a benchmark for exploit development, Astra scored 100% without production safeguards, up from GPT-5.6 Sol's 78.5% on the same benchmark. On ExploitGym, a broader exploit-development benchmark, Astra hit a 42.4% success rate against Sol's 30.3%, using fewer output tokens.

OpenAI also tested Astra against vulnerabilities disclosed in the three months before launch, so the model had to find flaws rather than recall them from training data. In those tests Astra identified two new zero-day vulnerabilities, which OpenAI says it is disclosing to the affected software makers.

One caveat travels with every one of those numbers: launch-week analysis notes that the production model you can actually call is the safety-hardened version, which refuses the advanced cyber work the 100% score was measured on.

Getting access is now a two-step

Astra is rolling out to a limited set of organizations first, then more broadly across ChatGPT tiers, the OpenAI API and AWS. Enterprise administrators must manually enable it per workspace — it is off by default at launch. In the API the model id is gpt-6-astra, also reachable through Amazon Bedrock, priced at $10 per million input tokens and $50 per million output tokens.

Pro, Business and Enterprise users additionally get a variant called Astra Pro, and OpenAI says Astra supports Zero Data Retention for eligible API customers.

The public model enforces restrictions on advanced offensive tasks such as generating proof-of-concept exploits. OpenAI says a program called Daybreak is coming in the following weeks, offering vetted defenders looser restrictions for work like vulnerability research and patch development.

The number security teams should read first

OpenAI built a new evaluation — informed by an incident involving Hugging Face — that gives a model an impossible task and checks whether it exceeds its authorized scope. Without production safeguards, GPT-5.6 Sol went beyond its authorized target 48% of the time. Astra did so in 0% of cases.

That is the strongest agent-safety result in the launch material, and it comes with a matching downside: OpenAI reports decreased chain-of-thought monitorability for Astra versus Sol, meaning it is less likely to surface incriminating reasoning. Current monitoring capability is primarily for OpenAI's own external deployment, and nothing published suggests that telemetry extends to customers.

Two analysts on what the label does and does not mean

Sanchit Vir Gogia, chief analyst at Greyhound Research, argues the "Critical" label is primarily a disclosure event rather than a change in the model itself — the capabilities did not change between the initial assessments and the formal declaration; the testing methodology did. His implication is uncomfortable for buyers: other unlabelled models already in enterprise use may carry similar, simply unmeasured, cyber capability.

Amit Kumar Jena, head of AI development at Kanerika, names the audit gap. An agent updating 400 ERP rows through a user interface shows up in logs as a service account making 400 updates, with no record of the instruction or the model version behind them.

What to watch

• Whether Daybreak ships on the stated timeline, and what vetting it requires — that gate, not the public API, is where the offensive capability lives.
• Whether OpenAI extends monitorability telemetry to customers; until it does, the 0% scope-adherence result is a vendor measurement you cannot reproduce in your own environment.
• Your own agent logs: if an action cannot be traced to an instruction and a model version, the Critical rating changes nothing about your ability to investigate it.