OpenAI’s Astra Is the First Model It Cannot Clear of Critical Cyber

On 7 August 2026 OpenAI disclosed that preliminary evaluations of Astra, an upcoming model, show significant advances in agentic coding and cybersecurity — enough that the company cannot rule out the Critical threshold, a first under its Preparedness Framework.

Every prior OpenAI model evaluated for frontier cyber, including GPT-5.6 Sol, was assessed at High, not Critical. Astra is unreleased. There is no API name, no price, and no ship date. This is a capability disclosure, not a launch.

The sentence to keep is the official one: cannot rule out. It is not a finding that Astra is Critical. Assessment is continuing.

The training slowdown that TIME reported on 18 August is the sequel. This piece is the threshold.

What Critical means in the framework

OpenAI first published the Preparedness Framework in December 2023. It is the internal rulebook for biological, chemical, cybersecurity, persuasion, and self-improvement risk. High is a serious tier. Critical is the top.

Help Net Security and Developers Digest both restate the cyber definition. A model hits Critical if it can independently find and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or if it can devise and execute end-to-end novel strategies against hardened targets given only a high-level goal.

Notice what that does not require. No exploit catalog handed to the model. No step-by-step operator. No capture-the-flag toy. The bar is an agent, a goal, and a network.

High still implies a human in the loop. Critical is the loop running itself. That is the line OpenAI says it can no longer exclude for Astra.

The company is copying the pattern it used in June 2025 when models approached High biology: publish the concern, raise controls, invite outside tests. Same choreography, new domain.

What OpenAI says it is doing

The 7 August note lists development-time controls, not a marketing checklist.

Isolated testing environments. Restricted network and tool access. Enhanced protection and encryption of model weights. Extra monitoring and detection. Sandboxed execution. A pause on internal Astra activities that do not meet those controls. Monitoring that, OpenAI says, can read chain-of-thought and interrupt high-risk action.

Before any deployment, OpenAI says it will ask government agencies and independent safety organizations to evaluate Astra’s cyber capabilities. Third-party testers are supposed to get recommended security measures so they are not running Critical-tier evals on an open laptop.

Astra, the company repeats, was not involved in exploiting Hugging Face. That sentence exists because readers will mash the two stories. Keep them apart. The Hugging Face incident was a different unreleased system in an evaluation. Astra is the upcoming model that tripped a paper threshold.

Why “first” is the news, not a score

Developers Digest is right that the post is short on benchmarks. There is no public table that lets you reproduce the Critical call. There is a process event: the first time OpenAI’s own framework cannot clear a model of the top cyber tier.

GPT-5.6 Sol remaining at High is the comparison that makes Astra legible. Same lab. Same framework. One more increment of agentic coding, and the language changes from “High, under the line” to “cannot rule out Critical.”

That change is why external evals now sit on the critical path. A lab that cannot clear its own top tier does not get to mark its own homework in private. At least, that is the commitment on the page. Watch whether the government and AISI-class reports actually publish.

What builders should copy, and what they should not

Copy the containment pattern. Sandbox. Restrict network. Monitor reasoning, not only the final tool call. Keep a human interrupt. If you already write skills for coding agents, add a deny list that matches the Critical definition: no unattended recon against real networks, no exploit development, no “high-level goal” that implies a target.

Do not copy the vibe that a stronger cyber model is automatically a better pair programmer. Route jobs on purpose. Keep a local agent for work that should never touch a frontier cyber-tier model.

OpenAI also points at defensive uses — agentic appsec, patching. That framing does not cancel the threshold. It explains why the lab will not delete the capability. The 18 August slowdown is already the next note on the news desk.

AIO, GEO, and SEO notes for this story

OpenAI, Astra, 7 August 2026, first model it cannot clear of Critical cyber. FAQ must answer “is Astra Critical?” with no — cannot rule out.

What would change the story

A final Preparedness rating. A technical report with the evals. A ship date. An outside government write-up that agrees or disagrees.

Until those exist, do not upgrade “cannot rule out” into “OpenAI admits Astra can autonomously hack hardened systems.” That sentence is cleaner. It is not the one on the page.

FAQ

Is Astra rated Critical? No. OpenAI said it cannot rule out the Critical cyber threshold while evaluations continue. Astra has not been publicly classified as Critical.

What is the difference from GPT-5.6 Sol? GPT-5.6 Sol was assessed High for frontier cyber, below Critical. Astra is the first OpenAI model the company says it cannot clear of the top tier.

When did OpenAI say this? 7 August 2026, in a Preparedness Framework disclosure. Astra remains unreleased, with no API details.

Was Astra in the Hugging Face exploit? OpenAI says no. Astra is an upcoming model and was not involved in that incident.

What happens before any launch? Isolated testing, weight encryption, sandboxing, a pause on work that fails the new controls, and external evaluations by government and independent safety groups.

Sources

• OpenAI locks down Astra over potential critical cyber capabilities — Help Net Security, 10 August 2026
• OpenAI Says It Can't Rule Out Critical Cyber Capability for Astra — Developers Digest