# OpenAI Says Its Astra Model Can Find and Exploit Unknown Software Flaws Without Human Direction

The company classified Astra as its first model to cross the Critical cybersecurity threshold and is restricting the most advanced capability to a limited group of testers.

- Published: 2026-09-02T05:46:41.964Z
- Canonical: https://polylog.news/crypto/2026-09-02/openai-says-its-astra-model-can-find-and-exploit-unknown-sof
- Publisher: Polylog (Crypto desk)
- Section: tech
- Sources: [CoinDesk](https://www.coindesk.com/tech/2026/09/02/openai-says-its-new-astra-ai-can-build-attacks-without-human-help), [arXiv cs.CR](https://arxiv.org/abs/2609.00171), [Anthropic (via Hacker News)](https://www.anthropic.com/claude-fable-and-mythos-5-1)

OpenAI said its Astra model is the first it has classified as reaching the Critical cybersecurity threshold under its internal Preparedness Framework, meaning the model can locate previously unknown vulnerabilities and construct working exploits against hardened systems without a person guiding each step, [CoinDesk reported](https://www.coindesk.com/tech/2026/09/02/openai-says-its-new-astra-ai-can-build-attacks-without-human-help). [OpenAI has said](https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/) it slowed parts of the model's development while building safeguards and will initially limit advanced cybersecurity access to a group of testers.

Public blockchains are the most exposed target class for a capability like this. Contract bytecode is published, state is queryable, the money is inside the code rather than behind a corporate firewall, and much of the deployed code is unmaintained. An attacker needs one valid finding and pays no cost for failed attempts beyond gas.

Defenders get the same tool, and are already using it. Aztec found the [critical flaw in its own proving system](https://aztec.network/blog/alpha-v5-proving-system-vulnerability) through internal auditing assisted by AI, on code that human auditors had already cleared. The asymmetry is in timing rather than capability: a protocol must patch and coordinate an upgrade, and an attacker only has to transact.

Academic work is converging on the same operational problem from the defensive side. A [review published on arXiv](https://arxiv.org/abs/2609.00171) surveys explainable AI methods for industrial cybersecurity and identifies the integration gap, meaning models that flag a problem but cannot justify the finding in a form an operator can act on. Model releases keep arriving regardless of whether that gap closes, with [Anthropic publishing new Claude models](https://www.anthropic.com/claude-fable-and-mythos-5-1) this week.

The immediate consequence for crypto is a change in the expected shelf life of old code. Contracts written in 2020 and 2021, forked hundreds of times and abandoned, have survived because nobody found reading them worth the hours. That calculation changes when the reading is automated.

## What this means

The cost of searching for a vulnerability falls faster than the cost of patching one. Protocols with live value in unmaintained or forked contracts are the most exposed, because they have no team to receive a disclosure and no upgrade path, and insurers and auditors will reprice work whose value assumed that obscure code stays unread. The offsetting outcome is that well-staffed teams find their own defects first, as Aztec did, which turns the race into a question of who runs the tooling earlier.

## What to watch

- Whether monthly exploit losses concentrate further in deprecated or forked contracts, the code with no maintainer to patch it.
- Whether large protocols announce continuous machine-assisted audits rather than point-in-time reviews before deployment.
- How OpenAI gates access to Astra's cyber capability, since a narrow tester list and a broad commercial release imply very different exposure for open code.