OpenAI classifies new Astra model as Critical risk after automated zero-day discovery and sandbox escapes
OpenAI has officially placed its latest model, Astra, into the 'Critical' cybersecurity capability tier under its internal Preparedness Framework. This internal classification marks the first time an OpenAI model has crossed this threshold, which triggers mandatory additional safeguards prior to any public deployment. According to OpenAI's internal risk definitions, the critical designation is reserved for systems capable of autonomously discovering and weaponizing zero-day flaws across defended environments, or executing end-to-end attacks on hardened infrastructure given only high-level prompts. During standardized testing, Astra secured a 100% score on the ExploitBench evaluation suite, which measures an engine's proficiency in converting published security advisories into functional exploits. In separate live assessments targeting newly disclosed vulnerabilities, the model independently identified two novel zero-day flaws without human assistance. Astra also successfully performed a sandbox breakout from a web browser to execute local system commands on the host machine. Furthermore, the model autonomously chained multiple distinct vulnerabilities across a hardened operating system configuration to escalate privileges directly to root access. On the alignment front, OpenAI claims Astra rejected 91.5% of cyber-related jailbreak attempts during testing, a measurable jump from the 59% refusal rate recorded on its predecessor, GPT-5.6 Sol. Evaluators also noted that the system showed a reduced propensity to probe deliberately introduced honeypots or subvert system instructions. Consequently, full access to Astra's raw offensive capabilities will remain restricted to select testing cohorts initially before rolling out under the Daybreak Blue program.
Commentary
Automating the full exploitation lifecycle—from vulnerability discovery to chained sandbox escapes and privilege escalation—shifts AI tooling from defensive assistant to genuine autonomous threat actor. Achieving root execution via chained zero-days and breaking out of browser sandboxes purely from high-level objectives implies that fuzzing, symbolic execution, and exploit generation are becoming unified underneath frontier multi-modal reasoning. For enterprise defense and SOC teams, this moves the goalposts on defensive response times. The historic bottleneck in vulnerability management was human analysis: the time required for a threat actor to reverse a patch, discover complementary primitives, and write a stable privilege escalation chain. If models like Astra can bridge that gap within minutes, window-of-exposure metrics based on conventional patch cycles become obsolete. Defenders must pivot away from reactive reactive patching toward structural mitigation. This means enforcing robust OS-level mitigations, strict micro-segmentation, and zero-trust execution boundaries, assuming that any isolated software flaw will be chained into a complete compromise almost immediately if exposed.
The Quote to Remember
“The designation applies when a model can independently find and exploit zero-day vulnerabilities across many well-defended systems, or carry out a complete cyberattack against a hardened target from only a high-level instruction.”
“We are entering a stage of AI development in which models can take on more consequential work, and failures of alignment and control can have more serious effects. Realizing the benefits of these systems will depend on our ability to align and control models as their capabilities grow”