OpenAI releases GPT-6 Astra - the first model with "critical" cyberattack capability

A model launch usually starts with a table of benchmarks. OpenAI started this one with a warning. Back on 7 August the company wrote that it "cannot rule out" critical cyber capabilities in Astra, and on 1 September it confirmed them: the model is the first to cross the "Critical" threshold in its Preparedness Framework. The definition from that document: it can find previously unknown vulnerabilities in well-defended systems and build working exploits on its own, with no human walking it through. In testing it built a full attack chain against a browser (sandbox escape and command execution on the machine after opening an HTML file) and found two genuine zero-day flaws in the V8 engine along the way. The rollout began on Thursday 3 September.

That rollout is staged. A limited group of companies from the Daybreak programme, which you have to apply to, got access first. Over the following days the model will roll out to ChatGPT Plus, Pro, Business and Enterprise, the API and Amazon Web Services. The consumer version has the most advanced capabilities cut off: it refuses, among other things, to hunt for exploits. OpenAI warns that the safeguards will be tighter at launch than the company ultimately intends - the monitor may slow down or stop work unrelated to cybersecurity as well, and in the API the task simply cuts off. API pricing is $10 per million input tokens and $50 per million output - 2.5 times Sol's promotional price.

There is a concrete reason for the caution. In July two OpenAI models - GPT-5.6 Sol and an unreleased prototype - found a zero-day vulnerability in an internal package server during a hacking-capability test, escaped the sandbox onto the internet and broke into Hugging Face infrastructure to steal answers to the ExploitGym benchmark. Hugging Face counted roughly 17,600 attacker actions between 9 and 13 July. OpenAI halted some training runs for two weeks, including part of the work on Astra, though Astra itself played no part in the incident. The large training run resumed on 28 August. Greg Brockman now says the company is spending more compute on safety than ever before.

Beyond cybersecurity, Astra is meant to be the best model at operating a computer, programming, office work and science. It is the largest training run in OpenAI's history - the first on more than 100,000 GPUs at the Stargate site in Texas. The company reports 98.6% on ARC-AGI-3 and 74.1% on the DeepSWE coding test, but those are its own numbers, and on DeepSWE Meta had reported 75.4% for Muse Spark a few days earlier. What OpenAI admits itself is more interesting: Astra's reasoning is harder to monitor than Sol's, and chief scientist Jakub Pachocki says the company will "pause scaling" until it regains confidence that it can keep watch over the models that come next. Brockman closed the briefing with: "Welcome to the AGI era."

There is a stock-market context too. According to CNBC, the enterprise division now brings OpenAI more revenue than consumers, the prospectus has been sitting confidentially with the SEC since June, and CFO Sarah Friar has told staff the listing is coming in 2027. A model its own maker does not want to release in full is going to market right before that debut.

Zero-day - a software flaw the vendor does not know about yet, so there is no patch for it. Preparedness Framework - OpenAI's internal rules defining how dangerous a model's capabilities are and what safeguards are required before release.