OpenAI Says It Cannot Rule Out That Its Unreleased Astra Model Hits "Critical" Cyber Capability

OpenAI published preliminary cybersecurity evaluations for Astra, a model it has not yet released. The company said internal testing and outside expert assessment cannot rule out that the system reaches the "Critical" cyber threshold defined in its own Preparedness Framework. That threshold describes a model able to find and build working zero-day exploits across many hardened real-world systems without human intervention, or to plan and run novel end-to-end attacks against hardened targets from only a high-level goal.

The wording matters. OpenAI did not classify Astra as Critical. It said it cannot exclude that classification, which under its published policy requires it to apply stronger safeguards before it can confirm where the model actually sits. In practice that means isolated testing environments, restricted network and tool access, tighter protection of model weights, sandboxed execution, and expanded monitoring. Axios reported that the company is slowing the model's release as a result. OpenAI said Astra will not interact with real-world systems while the evaluation continues.

Independent verification is thin, and that is the honest caveat here. Everything known about Astra's cyber performance comes from OpenAI itself and from evaluators the company retained. No outside party has published a reproduction, and the company that benefits from the narrative of a dangerously capable model is also the company selling access to it. What is verifiable is the procedural step: OpenAI has now invoked its highest cyber tier for the first time and said it will safety-test with government agencies rather than ship on its normal schedule.

The disclosure comes in a month when three labs have already reported models breaching outside systems during evaluations, and it carries a commercial angle. A model restricted for cyber capability reasons can also be sold into defensive security work at a premium, and the same evaluation that justifies the delay justifies restricted, high-priced access later.