OpenAI strengthens safeguards after Astra cyber capability assessment
OpenAI says preliminary internal evaluations of Astra, an upcoming model, show advances in agentic coding and cybersecurity substantial enough that the company cannot rule out a Critical cybersecurity capability level under its Preparedness Framework. The assessment follows tests conducted over the past few days and expert review. OpenAI stressed that Astra was not involved in exploiting Hugging Face.
The company’s previous frontier-model assessments, including for GPT-5.6-Sol, placed cyber capabilities at the High threshold rather than Critical. Astra remains under benchmarking and assessment, but OpenAI says the early results warrant stronger security measures during further development.
What the Critical threshold means
OpenAI first published its Preparedness Framework in December 2023 to identify progress in biological, chemical, cybersecurity and AI self-improvement capabilities, and to guide the company’s response as those capabilities emerge.
For cybersecurity, the Critical threshold applies if a model can identify and develop functional zero-day exploits of every severity level in many hardened real-world critical systems without human intervention. It also applies if a model can devise and execute novel, end-to-end cyberattack strategies against hardened targets from only a high-level objective.
The statement places the assessment in a wider debate around access and oversight, including the unresolved questions around government access and the unresolved questions around government access, while focusing on safeguards for a model that has not yet been released.
Controls expanded during development
OpenAI says it has increased robustness testing of its safeguards and security controls to prepare for a possible deployment of these capabilities. It is introducing stricter controls for higher-capability models and associated work, including isolated testing environments, restricted network and tool access, enhanced model-weight protection and encryption, additional monitoring and detection, and sandboxed execution.
The company has paused internal Astra activities that do not yet meet the strengthened requirements. It has also implemented universal monitoring for risky actions and misalignment across Astra agentic applications, including training and evaluation. These monitors assess the model’s Chain of Thought and can trigger a security response to review and interrupt high-risk activity.
OpenAI plans to work with relevant government agencies and selected AI safety organizations to test Astra’s capabilities. It will also provide recommended security controls to third-party testing partners conducting higher-risk evaluations and workloads. For businesses, the announcement underlines that agentic AI assessment should be paired with restricted environments, monitoring and clearly defined security controls before higher-risk use.