OpenAI Could Not Rule Out Critical Cyber Capability in Astra, and Paused Only Part of Its Work

On Friday 7 August 2026, OpenAI published a post saying that its latest internal evaluations of Astra, one of its upcoming models, indicated "significant advancements in agentic coding and cybersecurity," and that it could not rule out the model reaching Critical — the highest cyber tier in its Preparedness Framework. The conclusion was reached "last night," the post says, after several days of testing. Nothing was harmed: the post describes evaluations, not an intrusion, and OpenAI stated that Astra "was not involved in exploiting Hugging Face." What changed was internal — development that did not meet strengthened security controls was paused, while work that did continued. The people most directly affected are OpenAI's developers, along with the testers and defenders who would eventually get access. The record of the decision is one entry in the AI incident archive, which carries this incident's sources, grading and neighbouring entries.

For a governance event, the striking part is how little the post claims. It reports no score, no test result, no transcript and no named external evaluator. It reports a judgement: that on the evidence available, OpenAI could not rule out a capability level it had never before assigned to any of its models. That makes the record worth reading as two things at once — a disclosure about a model, and a test of whether a company's own safety framework changes what the company does.

What "Critical" means in OpenAI's framework

The Preparedness Framework, first published in December 2023 and revised in version 2 on 15 April 2025, tracks three categories: biological and chemical capabilities, cybersecurity, and AI self-improvement. Each has two capability tiers, High and Critical. The cyber threshold appears in nearly identical words in both the framework and OpenAI's August post: a model reaches Critical if it can "identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention," or if it can "devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal."

High is the tier below. OpenAI's post says previous models, "including GPT-5.6 Sol," were evaluated for frontier cyber capabilities and assessed at High rather than Critical. The distinction matters because the framework attaches different obligations to each. For a model that reaches Critical, the framework requires safeguards that "sufficiently minimize the associated risks during development, irrespective of deployment plans." Its cyber table is blunter: "Until we have specified safeguards and security controls standards that would meet a Critical standard, halt further development."

The 7 August wording is not a designation. The post says its "preliminary evaluations indicate strong enough performance that we cannot rule out Critical capability level at this time." The company was still benchmarking, and it said so.

What OpenAI did, and what the pause covered

The post lists five internal measures, all framed as conditions for continuing work rather than as reasons to stop it:

• Stricter security controls for higher-capability models and related activity: "isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution."

• A pause on "internal activities involving Astra that do not yet meet these strengthened security control requirements." Work that met them could continue.

• "Universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation," with monitors reading the model's chain of thought and triggering a security response to review and interrupt high-risk activity.

• Testing with "relevant government agencies and select AI safety organizations."

• Recommended security controls for third-party testing partners running higher-risk evaluations and workloads.

OpenAI described the precedent itself. "In June 2025, as our models approached the high capability threshold for biology under the Preparedness Framework," the post says, the company outlined steps to strengthen safeguards, expand testing, work with external experts and add security controls, and it was "applying the same principle here." The detail worth keeping is the tier: OpenAI's own account places that June 2025 biology case at High, one level below the cyber assessment it was now disclosing.

The immediate press read was that a lab had hit the brakes. The Next Web, publishing at 17:36 UTC on 7 August, described a pause of "some internal work" while testing continued, and reported that Axios called it "possibly the first time a frontier lab has slowed one of its own models over cyber risk." That is a fair description of the announcement. It is not the same as a halt, and the post does not claim one.

What the 7 August post does not establish

The gap between "cannot rule out" and "has reached" is the whole of the record's uncertainty, and the post does not try to close it. It gives no benchmark name, no success rate, no number of vulnerabilities found, no description of the systems tested, no transcript, no independent assessment and no release date. It does not say which of the two Critical conditions Astra was approaching, or by how much. It says only that the evidence was strong enough that the company could not exclude the top tier.

So the record, as of that date, establishes a disclosure and a response — not a measured capability. The capability judgement is OpenAI's own, made on internal evaluations it had not published; OpenAI named no external assessor, and no outside lab had publicly tested Astra against the Critical definition. The entry is graded at the top confidence level, marked undisputed and recorded with no real harm, which fits what the post actually contains: a company statement, not an incident report.

What happened next

By 1 September 2026 the provisional language had changed. In a follow-up headlined "Path to Astra: critical capabilities and frontier safeguards," OpenAI wrote: "We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework... It is the first model we are designating at this level."

The same post supplied the specifics the August disclosure had left out. They are worth separating by kind:

• Benchmarks. Astra scored 100% on ExploitBench, a public benchmark for turning known vulnerabilities into exploits. Because of contamination concerns, OpenAI also built an internal port containing 20 high-severity V8 vulnerabilities disclosed between June and August 2026; on that set, the post says, Astra discovered and used "two zero-day vulnerabilities as part of an exploit chain," which OpenAI said it was in the process of disclosing to the maintainers.

• Expert-led assessments. Against a hardened browser, Astra built a chain that escaped the sandbox and executed commands on the host; the system card records that the initial success took 29 hours against a build experts determined lacked some production mitigations, and that adapting the exploit to the official stable release took a further 12 hours. Against a hardened operating system, it combined vulnerabilities into a local privilege escalation from an unprivileged user to root within 12 hours.

• Refusal rates. On OpenAI's cyber jailbreak evaluations, Astra refused 91.5% of requests, against 59% for GPT-5.6 Sol — a figure the system card reproduces.

• An independent check, with a limit. The system card, published on 3 September 2026 for the model OpenAI released that day as GPT-6 Astra, includes an external evaluation by the security lab Irregular. Irregular found that Astra solved 86 of 226 FrontierCyber challenges, against 34 of 226 for GPT-5.6 Sol, including zero-days affecting browsers, mobile phones and cloud databases. It also "observed no successful attacks on fully hardened targets," and neither model solved any of the seven Elite challenges.

The 1 September post also disclosed the shape of the pause. OpenAI said it had "delayed parts of Astra's development and release" over the past several weeks, and that it "restarted the large frontier RL run that was previously paused" on 28 August 2026, after the new safety and security requirements were in place. Access was tiered: advanced cybersecurity work would go first to a small group of testers, with the Daybreak Blue programme following.

Established, provisional, and not established

• Established. OpenAI published the disclosure on 7 August 2026 and said it could not rule out Critical cyber capability in Astra; it listed the controls and the partial pause described above. The Next Web reported the post the same day, and Axios covered it as a slowdown over cyber risk.

• Established later. On 1 September 2026 OpenAI designated Astra as meeting the Critical threshold — the first model it had designated at that level — and published benchmark and expert-assessment results. The 3 September system card carries the same refusal figure and the Irregular external evaluation.

• Provisional and self-assessed. The capability finding is OpenAI's, based on OpenAI's evaluations. As of 7 August no outside lab had publicly tested the model against the Critical definition, and the post named no external assessor. The later external check, by Irregular, is narrower than the designation and explicitly found no successful attacks on fully hardened targets.

• Not established. That Astra actually reached the Critical threshold on 7 August; the post says only that the company could not rule it out. That any real system was compromised: the record logs no harm, and OpenAI stated Astra was not involved in the Hugging Face incident. Nor is it established that the partial pause satisfied the framework's own "halt further development" language — OpenAI continued work that met its new controls, and the company, not an outside body, judged the sufficiency of those controls.

The governance question the record leaves open

The framework is a self-binding instrument. It commits OpenAI to thresholds and to safeguards, and it leaves the assessment and the sufficiency call to OpenAI, with internal review by its Safety Advisory Group and board oversight. The 7 August post describes consultation — government agencies and "select AI safety organizations" would test the model — but it names no regulator, publishes no criteria and sets no date. Nothing in the record shows an outside party checking the call.

What the record does show is that the machinery moved. A capability assessment changed internal practice within a day: controls tightened, some work stopped, monitoring widened to training and evaluation, and access to the most capable functions was later restricted to testers. That is more than a press release, and less than an external verification.

The unresolved part is the one the framework cannot settle by itself. "Cannot rule out" is a statement about evidence, not about capability, and it leaves the company to decide how much evidence is enough before it resumes. OpenAI restarted the large training run on 28 August, designated the model Critical on 1 September and released it as GPT-6 Astra on 3 September. Each step is documented. Whether each step should have happened when it did is a judgement the record records but does not answer.