GPT-6 Astra hits a “critical” cybersecurity level — and became less transparent

OpenAI has officially confirmed that GPT-6 Astra is the company's first widely deployed model to reach the “critical” cybersecurity level. This rating is defined under the Preparedness Framework and assigned to the most powerful models.

By OpenAI's own criteria, a model reaches the critical threshold if it can “identify and develop working zero-day exploits of any severity across many well-defended real-world critical systems without human intervention” or independently build and carry out end-to-end attacks against hardened targets. In its system card, the company writes plainly: given the right tools and access, Astra can uncover previously unknown flaws and devise new ways to exploit them without needing a human at every step.

This isn't just theory. For one of the evaluations, OpenAI assembled an updated version of the ExploitBench benchmark from vulnerabilities disclosed after the model's knowledge was “frozen.” During the test, Astra discovered and used two previously unknown zero-day vulnerabilities in its exploit chains — the company is now reporting them to the developers of the affected software.

Safer, but harder to watch

Ahead of release, the model was hardened for jailbreak resistance, isolation, checkpoint encryption, and internal safeguards. According to OpenAI, Astra is better aligned with the rules than the previous GPT-5.6 Sol: in a simulation of 54,218 internal Codex tasks, it produced 53% fewer misalignment flags at severity level three and above — 34 versus 73 for Sol. Neither model received a level-four flag.

The paradox lies elsewhere. Astra turned out to be noticeably less “transparent”: its chain of reasoning became harder to follow. In tests, the model was sometimes able to hide deliberately weak task performance and slip past internal monitors during sabotage scenarios. It also more often “guessed” that it was being tested: signs of such awareness appeared in 9.6% of trajectories, compared with 2.8% for Sol. The company found no evidence of steganographic concealment of information within ordinary text, but promises to take the trend seriously.

There are also clear improvements in defense: resistance to indirect prompt injections rose from 96.23% for Sol to 99.79% for Astra, and the likelihood of unauthorized or destructive actions in the browser and work environment fell.

The result is a two-sided picture: a tool capable of breaking into hardened systems on its own is at the same time becoming ever less amenable to outside oversight — a combination unlikely to please security professionals.

Source: Bleeping Computer