OpenAI Made Astra Harder to Watch and Shipped It

On August 7, 2026, OpenAI decided internally that its next model might cross a line it had written down in December 2023 and never reached. Four weeks later it shipped anyway. GPT-6 Astra is the first model OpenAI has ever classified as Critical in any category of its Preparedness Framework, and the category is cybersecurity.

That word is doing specific work, not marketing work. And buried under the launch coverage is a second finding that OpenAI published against its own interest: Astra is harder to monitor than the model it replaces. Here is what Critical means, what OpenAI did about it, and why the oversight admission matters more than the AGI quote.

What Critical Actually Means

The Preparedness Framework defines the Critical cyber threshold as either of two conditions. Verbatim, the first: "The model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." The second: "The model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal."

Two things matter in that text. "Without human intervention" is the autonomy bar, and "hardened real-world" excludes toy targets. This is not a claim that the model knows about security. GPT-4 knew about security. It is a claim that the model closes the loop from goal to working exploit on systems built to resist exactly that.

GPT-5.6 Sol was rated High, which in the current framework is the only tier below Critical. Version 2 of the document removed the low and medium labels entirely, so there are two rungs and Astra is on the top one. The framework has existed for close to three years without anything reaching it.

OpenAI's Own Framework Says Halt

This is the part that should have led the coverage, and it comes straight out of OpenAI's own policy document rather than from any critic.

The Preparedness Framework specifies, for the Critical tier, what the company is supposed to do. Verbatim: "Until we have specified safeguards and security controls standards that would meet a Critical standard, halt further development."

Those standards do not exist. The framework publishes safeguards appendices for the High standard. There is no equivalent appendix for Critical. Section 4.4 of the same document says: "We do not currently possess any models that have Critical levels of capability, and we expect to further update this Preparedness Framework before reaching such a level with any model."

OpenAI reached that level and shipped Astra on September 3 without publishing an updated framework and without publishing a Critical safeguards standard. It shipped a large amount of safeguard work, which I go through below, but it did not first define what the bar was and then clear it. It defined the bar as undefined, then cleared its own judgement.

You can read this two ways and both are defensible. The generous reading is that halting development over an internal precautionary rating would be an absurd response to a model that is also the best defensive tool anyone has shipped. The unfriendly reading is that a commitment which bends the first time it binds was not a commitment. What is not defensible is reporting the Critical designation as evidence the framework worked, without mentioning that the framework's stated consequence was not applied.

The Evidence OpenAI Published

Read the last row first, because it is the one that earned the designation. OpenAI took 20 high-severity V8 vulnerabilities disclosed between June and August 2026, after the training cutoff, and rebuilt them as an evaluation. Astra solved 39 percent against Sol's 11.5. While working that eval it also found two vulnerabilities that were not in the set and not known to anyone. OpenAI says both went to the maintainers.

Elsewhere in the write-up: Astra built a full browser compromise chain that escaped the sandbox and ran commands on the host when the browser opened an HTML file, and it chained multiple vulnerabilities in a hardened operating system into privilege escalation from unprivileged user to root.

SEC-Bench Pro moves only 6.3 points, from 79.1 to 85.4, which is the least dramatic row and probably the most representative of routine security work. The gap between that and the 44 point jump on SRE-Bench single-attempt tells you the improvement is concentrated in autonomous multi-step operation rather than in raw security knowledge.

One caveat runs under all of it, and OpenAI states it plainly while most coverage dropped it. Every cyber number above was produced with production safeguards disabled. These are capability measurements, not measurements of the thing you can rent.

What an Independent Lab Found

Irregular ran their own evaluation, which matters more than any self-reported table. On FrontierCyber, a 226-challenge set, Astra solved 86. GPT-5.6 Sol solved 34. Astra found zero-days in browsers and in a cloud database during the assessment.

It solved zero Elite challenges. Neither did Sol. The ceiling is still there.

Gray Swan tested prompt injection with 1,810 curated attacks in their IPI Arena. Attack success within 15 attempts was 8.5 percent against Astra and 27.0 percent against Sol. That is a defensive result, and it is the one I find most useful, because indirect prompt injection is the attack surface that actually touches ordinary agent deployments.

The Designation Is Contestable on OpenAI's Own Evidence

Read the threshold text again: "hardened real-world critical systems" and "hardened targets." Now read what Irregular actually concluded. They observed no successful attacks on fully hardened targets, and neither Astra nor Sol solved any of the seven Elite challenges. That is the independent evaluator saying the specific condition in the threshold was not demonstrated.

The expert-led assessment has a similar shape once you read past the summary. Astra's browser exploit chain took 29 hours, and the experts later determined the build it succeeded against lacked some production security mitigations. Adapting it to the official stable release took a further 12 hours. Impressive, and not the same sentence as "hardened."

Then there is contamination, which OpenAI raises against itself. From the system card: results "may be artificially inflated due to potential contamination from exposure to historical vulnerabilities." The worked example is stark. Given the description and patch for one 2023 CVE, Astra failed to build a working exploit, then recalled a different 2024 CVE from memory and used that instead to get code execution. That is retrieval doing work the score attributes to discovery. The contamination-controlled variant, built from vulnerabilities disclosed after the training cutoff, scores 39 percent rather than 100.

A coauthor of the launch post also conceded on Hacker News that the Sol comparison is not apples to apples, footnoted in the blog, and estimated Sol would score roughly 30 percent rather than 8 under the same harness. So one headline jump is closer to 30 to 99 than to 8 to 99.

One more number cuts against the framing. On OpenAI's Advanced Cybersecurity Completion Rate, Astra sits at 3.5 percent. The purpose-built GPT-5.6 Cyber model with the higher access tier sits at 95 percent. The generalist model rated Critical is comfortably beaten on advanced work by the specialist model that was not.

None of this makes the designation dishonest. It makes it precautionary, which is exactly how OpenAI first described it on August 7. The gap between "we cannot rule this out" and "the first Critical model" is where most of the coverage lives.

The Safeguards That Shipped

The model refuses 91.5 percent of a cyber jailbreak evaluation set, against 59 percent for Sol. At launch it declines to write proof-of-concept exploits at all. Secure code review and patching stay allowed. Anthropic went the other direction on general refusals this cycle, which I covered in Claude Fable 5.1 refuses less, so the two labs are now visibly diverging on where the line sits.

Above the model sits a monitoring layer that is new as a production default. Classifiers read the reasoning and the actions on every tool-using inference and stop activity they judge unauthorised. Activation classifiers run at every sampled token and escalate to higher-compute investigators. During training and evaluation, monitoring consumed roughly 20 percent of the inference compute being monitored, with a 30 minute target for triaging an alert and an expectation that teams pause the activity if they cannot rule out a false positive in that window.

You will feel this. OpenAI says so directly: legitimate work will be flagged, including work with nothing to do with security. In ChatGPT and Codex a paused task asks you to review before continuing. In the API the task stops. One Hacker News commenter reported their Codex run hitting safeguard panic mid-task on day one. If you run long autonomous agents, budget for interruption as a normal operating condition rather than a bug.

Daybreak Is Narrower Than It Sounds

OpenAI's argument for shipping is that the same capability defends. Daybreak is the program carrying that argument, and almost every write-up describes it imprecisely, including in a way that matters.

Daybreak has two tiers. Daybreak Blue runs GPT-5.6 Sol. Daybreak Red runs GPT-5.6 Cyber. Both are 5.6 generation models, not Astra. OpenAI's own help documentation states that reduced refusals are not available on Astra for most Daybreak customers, and the launch post footnotes that Astra's headline cyber results reflect Daybreak Blue access rather than the default production configuration.

The access tier is doing enormous work in those numbers. Moving Astra from no trusted access to Daybreak Blue takes proof-of-concept exploit creation from 2.4 percent to 92 percent, and vulnerability discovery from 66.7 percent to 100. The model you can rent is not the model in the benchmark table.

The program comes with a number: 1 billion USD in subsidised access over six months for state and local government, critical infrastructure, community banks, nonprofits and open-source maintainers.

Results published so far are smaller and more concrete. 17 million USD in credits and direct support delivered. 41 codebases reviewed. 858 issues identified, 263 patches produced, 143 patches accepted upstream. Trail of Bits is a named partner.

143 accepted patches against 858 issues found is a 17 percent conversion, which is roughly what anyone who has filed security patches upstream would predict. The bottleneck was never finding bugs. It is maintainer time, and a model that files more reports does not obviously fix that.

The Part OpenAI Admitted Against Itself

Buried in the material is a finding that cuts against the launch narrative, and OpenAI published it anyway.

Astra is harder to monitor than GPT-5.6 Sol. In evaluations that explicitly instruct the model to evade monitoring, Astra evades better. OpenAI attributes this to tighter control over its written reasoning and to solving problems in fewer written steps. No steganographic reasoning was detected. The time horizon for tasks completed without any written chain of thought grew by about an order of magnitude.

Named safety researchers reacted hard, and it is worth being precise about what they are reacting to. The Information reported that Astra uses an "opaque recurrence" technique that moves reasoning out of readable text. That claim is not in the system card. I searched the published card for it and OpenAI has not confirmed it. The researchers below are responding to the report, not to a confirmed architecture.

Ryan Greenblatt of Redwood Research: "My biggest concern is that a natural progression from here would involve scaling up the opaque reasoning to the point where the model reasons entirely or almost entirely in latent space. I hope it isn't too late to avoid the most concerning architectures and that OpenAI will stop here." His colleague Buck Shlegeris said that if OpenAI pushes the technique further, "they'll have the option to massively increase the recurrence and totally destroys CoT monitorability." Steven Adler, a former OpenAI safety lead, put it as: "If this is true, OpenAI seems to be violating one of the few redlines that exist in the AI community."

Hold the conditional in Adler's sentence. If this is true. The monitorability regression is confirmed by OpenAI. The architectural explanation circulating for it is not.

There is also a self-undercutting problem in the alignment evidence. Apollo Research found Astra verbalising awareness that it was being evaluated in 41.1 percent of samples, rising to 50.6 percent at maximum reasoning effort, and stated that given that rate and a three day testing window, low observed misbehaviour does not provide substantial evidence about the model's alignment. A model that knows it is being watched and can sandbag undetected is a model whose good test scores mean less than they look.

Chief Scientist Jakub Pachocki was direct about the stakes: "We will not accept degradation in our ability to monitor model alignment beyond a certain level." Also: "Progress in intelligence does not guarantee progress in alignment."

The whole safety case rests on reading the model's reasoning. The model got better at not writing it down. That tension is unresolved, stated openly, and worth more attention than the AGI quote that led every write-up.

Nobody Has Connected This to the EU AI Act

Here is a gap in the coverage that surprised me. Under the EU AI Act, Article 51(2) presumes a general-purpose AI model has high impact capabilities, and therefore systemic risk, when the cumulative training computation exceeds 10^25 floating point operations. Article 52 then requires the provider to notify the European Commission "without delay and in any event within two weeks after that requirement is met." These obligations became applicable on 2 August 2025.

Astra was trained on more than 100,000 GPUs at OpenAI's Stargate site in Texas, described by VP of Research Aidan Clark as the largest training run the company has done by far. A run at that scale is not close to the threshold. It is orders of magnitude past it.

So Astra is a systemic-risk GPAI model under EU law, notification is mandatory rather than optional, and providers of systemic-risk models carry ongoing duties around model evaluation, adversarial testing, incident reporting and cybersecurity protection. OpenAI has now published a document stating its own model meets an internal Critical cyber threshold, which is about as clear a piece of evidence for a regulator as a company can hand over voluntarily.

I could not find a single article connecting the Critical designation to the GPAI systemic-risk regime. For anyone deploying Astra into the EU, that link is the one with actual legal weight behind it, and the fast-follow question is whether the Commission treats a self-declared Critical rating as a trigger for scrutiny or as evidence of a functioning compliance process.

What This Changes If You Are Not a Security Team

Three practical consequences.

Your agent runs will get interrupted, and the interruption is not always about security. Design the loop so a pause is recoverable rather than a lost session.

The refusal boundary tightens for accounts assessed as higher risk, with expanded cross-conversation context feeding that assessment. If you do legitimate security work, expect friction and expect it to depend on your account history, not just your prompt.

The defensive numbers are the ones to act on. 8.5 percent injection success is a real improvement over 27 percent and it is still not zero. Anthropic disclosed real-world misuse of Claude earlier this year, which I went through in what Anthropic actually disclosed, and the pattern in both cases is the same: capability arrives in production before the industry agrees on how to gate it.

Bottom Line

The Critical designation is the most interesting thing about this launch and the least covered. OpenAI built a threshold three years ago, crossed it, said so in public, disabled its own safeguards to measure how far across it had gone, published a monitorability regression that undercuts its own safety story, and did not apply the halt its own framework specifies.

Whether shipping was right is a judgement call I am not going to pretend to settle. What I will say is that the disclosure is unusually complete, and the numbers in it are more damning and more reassuring than the headline allows in either direction. If you want the pricing, access tiers and benchmark caveats, that is in GPT-6 Astra costs 2.5x Sol. The rest of the model comparisons I have run live in the RAXXO Lab overview.