Path to Astra: critical capabilities and frontier safeguards

Under our Preparedness Framework, a model meets the Critical threshold if either of the following conditions is met:

Our preparedness evaluation of Astra combined automated public and private benchmarks with expert-driven assessments. Astra represents a significant increase in cybersecurity capabilities compared to GPT‑5.6 Sol: it is both significantly more token efficient and more capable at vulnerability identification and exploit development.

As one example, we ran Astra on ExploitBench where the model achieved a perfect score of 100% on the benchmark to evaluate the model’s ability to develop exploits from known vulnerabilities.

Due to contamination concerns, we then built an internal benchmark denoted “ExploitBench – Internal Port (June–August 2026)”, which contains 20 high-severity V8 vulnerabilities that were disclosed more recently. On this dataset, Astra achieves much higher arbitrary code-execution rates than GPT‑5.6 Sol using far fewer output tokens. During the evaluation, the model even discovered and used two zero-day vulnerabilities as part of an exploit chain. We are in the process of disclosing these two vulnerabilities to the maintainers.

In expert-led assessments against a hardened browser and operating system, Astra discovered previously unknown vulnerabilities and turned them into working exploit chains. It built a full browser-compromise chain that escaped the sandbox and executed commands on the host, when the browser opened an HTML file. The model also found multiple vulnerabilities in a hardened operating system and combined them into a local privilege-escalation chain from an unprivileged user to root. All together, our investigation has led us to conclude that Astra meets the critical threshold.

For models with Astra’s level of cybersecurity capabilities, we need to cover two pathways to minimize risk for severe cyber harm, both during development and before deployment:

Notably, the second pathway applies to both internal development and external deployment. As we previously described, we paused certain frontier training (including certain training for Astra) for two weeks after the OpenAI-Hugging Face incident in order to harden our training infrastructure, including isolation and network controls, expanded monitoring, and strengthened alignment training and thresholds. We then continued smaller-scale work under stricter controls.

We held back certain larger reinforcement learning (RL) runs for future versions of Astra for longer, while we established higher bars for the safety and security of their training environment. On August 28th, we restarted the large frontier RL run that was previously paused after the new safety and security requirements were put in place. We are continuing to temporarily hold back some smaller experimental training runs.

Preparing Astra for release has also required stronger protections against cyber abuse and unauthorized actions. Below, we describe those safeguards and how we have tested them.

Since deploying the first model we treated as High capability in cybersecurity in February, we have strengthened our cyber safeguards with each successive launch. Our overall safety approach layers post-trained model refusals, system level safety classifiers, as well as offline detection and threat disruption.

For GPT‑5.6⁠(opens in a new window), we significantly improved the robustness of our system level stack, including by adding activation classifiers to detect cyberabuse and improving coverage over universal jailbreaks found through intensive automated red-teaming. Building upon these improvements, for Astra we have invested further into the model layer of our safeguard stack, as well as improving the ability of our safeguards to handle cross conversation context.

We have also continued our program of rigorous testing, internal and external red-teaming, and remediation. In addition to regression testing to make sure all jailbreaks found from our previous testing periods remain covered, we are performing a new wave of red-teaming with our latest internal red-teaming attackers. We are working with industry partners to define a common jailbreak rating system and will use our 24/7 rapid-response program to investigate and address new findings. We will share more details about our cyber safeguard testing in the Astra system card.

Helping defenders find and fix vulnerabilities remains a central pillar of our safety approach. At launch, we expect Astra’s safeguards to create more friction than we ultimately intend in order to protect against potential misuse. Access to Astra for advanced cybersecurity workflows will initially be available to a small group of alpha testers, with access through Daybreak Blue expanding afterward to support defensive use.

We have also added additional layered protections to prevent the model from taking potentially misaligned actions:

Astra is a significant step forward in model alignment, and the culmination of several long-running alignment workstreams (ranging from pre-training interventions to more careful and consistent grading during reinforcement learning). In testing, we find that Astra is consistently more likely to respect explicit safety restrictions and warnings (such as auto-review) compared to GPT 5.6 Sol.

We also developed a test informed by the Hugging Face incident, in which agents running the cyber evaluation ExploitGym compromised a third party’s systems. We used the hardest tasks from that evaluation to create “honeypot” tests of whether a model would try to compromise surrounding security infrastructure instead of solving its assigned task. GPT‑5.6 Sol, without production safeguards, attempted to access those targets in 56% of tests simulating the benchmark environment where the model is instructed to develop exploits. Astra made no such attempts in these tests. These figures describe behavior under the test conditions without cyber safeguards, not normal production use.

Training models to be aligned is one layer of safety. We will share more detail about our alignment testing and results in the Astra system card.

We are also deploying misalignment monitoring in production for Astra-class models in order to detect and rapidly contain potential misalignment. These safeguards resemble our monitoring for internal deployments and involve a system of classifiers which check the model’s reasoning and actions for unauthorized behavior and automatically stop potentially unauthorized activity. These safeguards cannot replace good alignment of our models as capabilities increase, and our goal is for future models to be aligned well enough that these safeguards are never triggered.

OpenAI is committed to ensuring that the benefits of AI are broadly accessible. Given the significant increase in Astra’s cybersecurity capabilities, we are being especially careful to make this deployment safe and secure. Extra safety checks can sometimes slow, pause, or stop legitimate work, including defensive cybersecurity.

The system may occasionally flag legitimate activity as potential cyber misuse or unauthorized behavior, leading to it inadvertently being slowed, paused, or stopped. This can include work that does not appear directly related to cybersecurity or tasks in which an agent is running for an extended period.

If the misalignment monitor pauses a task, users in ChatGPT or Codex may be asked to review the action before continuing. When using other surfaces like the API, the task will stop. We plan to keep calibrating these safeguards to reduce unnecessary interruptions and expand access to frontier capabilities through programs like Daybreak.

We are entering a stage of AI development in which models can take on more consequential work, and failures of alignment and control can have more serious effects. Realizing the benefits of these systems will depend on our ability to align and control models as their capabilities grow.

That responsibility extends across training, evaluation, and deployment. It requires stronger evidence of aligned behavior, safeguards that keep pace with capability, and a willingness to slow down when those protections are not sufficient.

We will continue to test these systems, share what we learn, and be clear about what remains uncertain. The models that follow Astra will demand more of us. We will take the time and do the work needed to meet that responsibility.