Responding to the next frontier of critical cyber capabilities

OpenAI said Thursday it concluded last night that it cannot rule out critical cyber capabilities in its upcoming model Astra under its Preparedness Framework. The company said internal evaluations over the past few days showed significant advancements in agentic coding and cybersecurity that prompted the assessment. OpenAI said a model reaches the Critical cybersecurity threshold if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention. The company said previous models including GPT-5.6-Sol were assessed at the High threshold rather than Critical. OpenAI said it has scaled up robustness testing of safeguards and security controls and implemented stricter security controls for higher-capability models. The company said it is pausing internal activities involving Astra that do not meet strengthened security requirements and will work with relevant government agencies and select AI safety organizations to test the model's capabilities. OpenAI said the framework guided similar steps in June 2025 when models approached the high capability threshold for biology. The company said it believes advanced cyber-capable models should help defenders identify and address vulnerabilities before attackers do.