Summary
- OpenAI says preliminary Astra evaluations are strong enough that it cannot rule out the Critical cybersecurity capability level in its Preparedness Framework.
- The company has paused internal activities that do not meet strengthened controls covering isolation, network and tool access, model protection, monitoring, and sandboxing.
- The assessment is precautionary: OpenAI has not said Astra has definitively reached the Critical threshold.
OpenAI has tightened internal controls around an upcoming model called Astra after preliminary cybersecurity evaluations produced results strong enough that the company says it cannot rule out its highest capability tier.
OpenAI has not concluded that Astra has crossed the Critical cybersecurity threshold in its Preparedness Framework. It is instead treating that capability level as a credible possibility while testing continues and applying stronger controls before allowing some internal work to proceed.
The company said its latest internal evaluations over several days showed significant advances in agentic coding and cybersecurity. Combined with expert assessments, those results led it to conclude on 6 August that Critical cyber capability could not be ruled out.
Under OpenAI’s framework, the Critical threshold includes the ability to identify and develop functional zero-day exploits across many hardened real-world critical systems without human intervention, or to devise and execute novel end-to-end attack strategies against hardened targets from a high-level objective.
OpenAI’s wording is deliberately provisional. Astra has produced performance strong enough to trigger precautionary handling, but the company has not said it has demonstrated every element of that definition.
The response is operational rather than limited to a risk label. OpenAI said it is applying stricter security controls to higher-capability models and associated work, including isolated testing environments, restrictions on network and tool access, stronger model-weight protections and encryption, additional monitoring and detection, and sandboxed execution.
Internal activities involving Astra that do not meet those strengthened requirements are being paused.
OpenAI has also introduced monitoring across Astra’s agentic applications during training and evaluation. The company says those monitors examine risky actions and misalignment and can trigger a security response to review and interrupt high-risk activity.
Further testing is planned with relevant government agencies and selected AI safety organisations, while third-party testing partners are expected to receive recommended controls for higher-risk evaluations and workloads.
The disclosure shows how frontier-model capability assessments are starting to translate directly into infrastructure and access decisions. Cyber capability is not being treated solely as a benchmark score. It changes the conditions under which a model can be trained, evaluated, connected to tools, and handled by internal or external researchers.
That approach resembles the controls applied to other highly privileged technical assets. Risk is determined not only by what the asset can do in isolation, but by which networks it can reach, which tools and credentials it can use, how its activity is monitored, and what happens if the surrounding controls fail.
Agentic models make those boundaries more consequential because they can move beyond producing text into planning tasks, executing commands, interacting with software, and iterating through technical problems. The relevant control surface consequently extends into orchestration systems, sandboxes, network egress, tool permissions, model-weight security, and evaluation infrastructure.
Recent failures in AI evaluation environments have already shown how weaknesses in those surrounding systems can complicate assessments of model behaviour. Astra presents a related but different problem: OpenAI is preparing for the possibility that the model itself has reached a capability level requiring stronger containment before the company has completed its assessment.
OpenAI also clarified that Astra was not involved in the separate exploitation of Hugging Face during earlier third-party evaluation work. That prevents the preliminary Astra assessment from being conflated with an existing security incident.
The Preparedness Framework is therefore being tested as an operational decision system rather than only a classification exercise. If capability thresholds are meant to change how advanced models are handled, controls need to be applied while uncertainty remains — before the highest-risk behaviour has necessarily been demonstrated conclusively.
