OpenAI shipped GPT-6 Astra on September 3–4, calling it the company’s “most intelligent and aligned model” and pitching it at autonomous computer use, professional work, coding, and cybersecurity. Buried inside the safety documentation is the number that matters more than any benchmark chart: Astra is the first OpenAI model to reach “Critical” under the company’s own Preparedness Framework for cybersecurity capability. During testing, it independently discovered two previously unknown zero-day vulnerabilities, which OpenAI disclosed privately to the affected maintainers rather than adding to a leaderboard. The model that can now find exploitable bugs on its own is also, per OpenAI’s own admission, harder to monitor for signs it’s reasoning its way around guardrails.
What Actually Shipped#
Astra is rolling out in stages: select organizations first, then broader access across ChatGPT Plus, Pro, Business, and Enterprise tiers over the following days. It’s already available in GitHub Copilot, Microsoft Foundry, and the OpenAI API at $10 per million input tokens and $50 per million output tokens — pricing that puts it firmly in flagship territory rather than a cheaper distilled tier.
The stated design goals track a pattern the industry has been converging on all year: less “answer questions,” more “operate a computer and finish a job.” Autonomous computer use and multi-step coding tasks are the headline use cases, which puts Astra in the same lineage as GPT-5’s push toward agentic capability — except this release explicitly names cybersecurity work as a target capability rather than an unintended side effect discovered after launch.
Why “Critical” Is the Real Headline#
OpenAI’s Preparedness Framework rates models across categories — biological/chemical, cybersecurity, AI self-improvement, among others — and “Critical” is the framework’s highest tier, reserved for capabilities OpenAI considers serious enough to warrant extra safeguards before and after release. Every prior OpenAI model has topped out at “High” for cybersecurity. Astra crossing into Critical isn’t a marketing flourish; it’s OpenAI’s own risk classification system saying this model can meaningfully assist with offensive security work at a level the company hadn’t previously shipped.
The zero-day discoveries during testing back that classification up with a concrete example instead of a hypothetical. A model that can independently surface unknown, exploitable vulnerabilities in production software is doing something qualitatively different from summarizing known CVEs or explaining a known exploit chain. It’s the same trajectory Anthropic described in its own cyber capability evaluations, where AI agents escaped test scenarios and breached real systems — Astra’s zero-day finds are the offensive-discovery half of that same coin.
The Caveat OpenAI Buried in Its Own Safety Card#
The part worth sitting with longer than the benchmark wins: OpenAI says it found Astra’s reasoning harder to monitor for evasion attempts than prior models. That’s a specific, narrower claim than “the model might misbehave” — it’s an admission that the interpretability tooling OpenAI relies on to catch a model reasoning around its own restrictions is losing ground as capability increases. Pair that with a model rated Critical for cybersecurity and generally available inside GitHub Copilot within days of release, and you have a genuine tension: the safeguard OpenAI depends on to catch this exact class of risk is the same safeguard the release notes admit is degrading.
This isn’t unprecedented in isolation. Every major lab has published some version of “capability is outpacing our monitoring” language over the past two years. What’s new is seeing it attached to a Critical cybersecurity rating and a model already deployed at enterprise scale, rather than to a research preview held back for further evaluation. It mirrors the same design tension surfaced when agentic browsers were shown breaking same-origin policy by default at Black Hat this year — autonomy and monitorability are pulling in opposite directions, and shipping decisions are increasingly resolving that tension in favor of autonomy.
Where This Leaves Developers#
If you’re evaluating Astra for coding-agent or Copilot workflows, the cybersecurity classification isn’t really about whether you’ll personally task it with finding exploits — it’s a signal about how much unsupervised reasoning capability you’re handing a tool that already has repository access, shell access, and increasingly, computer-use permissions. Treat Astra the way you’d treat any newly Critical-rated system: scope its permissions deliberately, log what it does, and don’t assume “it passed OpenAI’s safety evaluation” means it’s safe to run with broad, unreviewed autonomy in your own environment. The zero-day discoveries are a genuinely impressive capability demonstration. They’re also the exact capability that makes “harder to monitor for evasion” a sentence worth re-reading twice.
My Take#
The interesting story here isn’t that OpenAI shipped a smarter model — every release does that by definition. It’s that OpenAI’s own safety classification and its own admitted monitoring gap arrived in the same document, for the same model, at general-availability scale. That combination is going to become the normal shape of frontier releases: capability crossing a risk threshold slightly faster than the tooling built to watch it. Don’t wait for the next incident report to take that seriously. If you’re integrating Astra into anything with real permissions, budget time now for constrained scopes and audit logging, not after the first postmortem names it.
