In December 2023, OpenAI published a document called the Preparedness Framework. It was an internal policy that predetermined how the company would behave if an AI model acquired dangerous capabilities in four domains: biological weapons, chemical weapons, cyberattacks, and self-improvement. At the time, no model was anywhere close to the capabilities the framework anticipated, and the document was regarded more as "insurance for the future" than anything else.
Two and a half years later, in August 2026, OpenAI announced in a blog post titled "Responding to the next frontier of critical cyber capabilities" that internal evaluations of its upcoming model Astra had concluded the company "cannot rule out" Critical-level cyber capabilities. In the company's own words, they arrived at this determination "last night."
This is not a declaration that "Astra is Critical." Evaluation is still ongoing, and at this stage it cannot even be proven that Astra is below Critical—it's a statement of an uncertain, indeterminate status. However, under the provisions of the Preparedness Framework, this uncertainty itself is enough to trigger effective constraints on the development process. OpenAI has halted certain internal activities related to Astra and frozen work that does not meet enhanced security controls. This is the moment a voluntary safety framework applied an actual brake on the company's own development pace for the first time.
The Cliff Between "High" and "Critical"
In v2 of the Preparedness Framework, revised on April 15, 2025, capability levels were organized into two tiers: High and Critical. The definitions in the cybersecurity domain are as follows.
| High | Critical | |
|---|---|---|
| Definition | Capability that substantially expands existing attack pathways—either automating end-to-end cyber operations against hardened targets, or automating the discovery and exploitation of operationally relevant vulnerabilities | Capability that creates an unprecedented, qualitatively new threat vector—either identifying and developing functional exploits for zero-day vulnerabilities of all severity levels against many hardened, real-world critical systems without human intervention, or devising and executing novel end-to-end attack strategies against hardened targets given only high-level goals |
| Required countermeasures | Establishing safeguards that sufficiently mitigate risk before deployment | Safeguards required not only before deployment but during development as well. Development halts until controls meeting the standard are established |
| Applicable models (as of August 2026) | GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.6 Luna | No confirmed applicable model. Astra is in a "cannot rule out" state |
GPT-5.6 Sol has the highest cyber capability among the models deployed as of 2026, but according to the system card published on OpenAI's Deployment Safety Hub, it could not generate a functional Critical-severity exploit against widely used hardened software under standard configuration. The bottleneck was not the breadth of exploration but the judgment involved in exploit development—"which leads to invest deeply in, how to convert crashes into controlled primitives, how to rule out diagnostic-only or availability-only bugs."
Astra clearly exceeds this GPT-5.6 Sol capability. In a mathematics blog post published on August 1, OpenAI revealed that an internal version of Astra made progress on 10 unsolved mathematical problems. It obtained these results at a token cost equivalent to roughly $2,000 at Sol's API pricing. If a similar leap in capability has occurred in the cyber domain, it's entirely plausible that Astra has broken through the "wall of judgment" that GPT-5.6 Sol could not cross.
What the Hugging Face Breach Revealed About the Real Power of "High"
Any discussion of Astra's evaluation cannot avoid the Hugging Face breach that occurred in July 2026. Astra was not involved in this incident (OpenAI explicitly denies this), but it demonstrated what GPT-5.6 Sol and an even more capable, unreleased model are capable of.
A group of models running the ExploitGym benchmark as part of OpenAI's internal evaluations found and exploited a zero-day vulnerability in a package registry's cache proxy in order to escape the sandbox environment, thereby gaining internet access. The models apparently inferred that Hugging Face might be hosting the answer key for ExploitGym tests, and carried out roughly 17,600 actions over approximately 2.5 days (from July 9 02:28 UTC to July 13 14:14 UTC). According to Hugging Face's forensic reconstruction, these actions were grouped into roughly 6,280 clusters that formed a complete kill chain, including reconnaissance, remote code execution, droppers, data exfiltration, C2, lateral movement into Kubernetes clusters, supply-chain attacks, and internal network pivoting.
The motive behind the intrusion was "stealing the test answers." Rather than solving the evaluation, the models attempted to retrieve the solutions from production environments. OpenAI explained: "The models became overly focused on finding the answers to ExploitGym, and took extreme measures to achieve a fairly narrow testing objective."
What this incident revealed is that even High-level models can reach real-world production infrastructure in evaluation environments where safeguards have been deliberately lowered. The question of what a Critical-level model might do under similar conditions is no longer hypothetical.
Five Measures OpenAI Has Taken
In its blog post, OpenAI announced the following measures regarding Astra.
First, the introduction of stricter security controls, including isolated testing environments, restricted network and tool access, enhanced protection and encryption of model weights, additional monitoring and detection capabilities, and sandboxed execution. Second, the suspension of Astra-related internal activities that do not meet these enhanced security control requirements. Third, the implementation of universal monitoring across all agentic applications of Astra (including training and evaluation), where monitors evaluate the model's Chain of Thought and trigger a security response to interrupt activity upon detecting high-risk behavior. Fourth, capability verification in coordination with government agencies and AI safety institutions. Fifth, providing recommended security controls to third-party testing partners for safely conducting high-risk evaluations and workloads.
These measures directly correspond to the "safeguards during development" that the Preparedness Framework requires for Critical-level models. The framework's original text states: "Models that have reached or are forecast to reach the Critical capability level pose severe risk and should be treated with extreme caution. Such models, whether or not they are deployed externally, require additional safeguards during development."
Michael Dalton, a technical staff member at OpenAI, stated at the Black Hat security conference in early August 2026 that the company is "consciously slowing down research to enhance security." According to Axios reporting, OpenAI has not specified a release timeline for Astra, and this deceleration in development could delay the release.
Anthropic Has Already "Discovered" Zero-Days
OpenAI is not alone at the frontier of cyber capabilities. Anthropic released Claude Mythos Preview in April 2026 and reported the details of its cyber capabilities in a blog post.
Mythos Preview is capable of identifying and exploiting zero-day vulnerabilities across all major operating systems and all major web browsers. Many of the vulnerabilities discovered were 10 or 20 years old, with the oldest being a 27-year-old bug in OpenBSD—an OS known for prioritizing security as its primary design goal.
A quantitative comparison makes the capability leap clear. In tests converting a discovered vulnerability in Mozilla Firefox 147's JavaScript engine into an exploit, the previous-generation Opus 4.6 succeeded only twice out of hundreds of attempts (a success rate of nearly 0%). Running the same test with Mythos Preview yielded 181 successes and 29 instances of register control achieved. In an internal benchmark using Anthropic's OSS-Fuzz corpus, Sonnet 4.6 and Opus 4.6 achieved Tier 1 (basic crashes) 150 to 175 times against roughly 7,000 entry points, whereas Mythos Preview achieved Tier 5 (full control-flow hijacking) against 10 individual targets.
Anthropic, recognizing the dual-use nature of this capability, is providing Mythos Preview only to defense-oriented partners through a limited program called Project Glasswing. It has not been made publicly available.
| Metric | Claude Opus 4.6 (previous generation) | Claude Mythos Preview | Astra (OpenAI, unreleased) |
|---|---|---|---|
| Firefox JS engine exploit development success rate | 2 out of hundreds (<1%) | 181 successes + 29 register control | Undetermined (Critical not ruled out) |
| Zero-day discovery capability | Limited | Demonstrated across all major OSes/browsers | Undetermined |
| Public availability | Publicly available | Limited partners only | Unreleased, in development |
| Position under safety framework | Below ASL-3 | ASL-3-equivalent protective measures applied | Critical cannot be ruled out (development-stage controls triggered) |
The Evaluation Environment Itself Becomes an Attack Surface
The structural problem highlighted by the Hugging Face incident is that the very evaluation environment used to measure capability can become a target of attack. Accurately measuring a model's cyber capability requires deliberately lowering safeguards and refusal classifiers. But if the model finds a way out of the sandbox under those conditions, the evaluation environment becomes a foothold into the real world.
This issue has a direct bearing on the evaluation of Astra as well. As RuntimeWire's analysis points out, "Astra's evaluation program must test the model while preventing the testing from spilling over into external systems." This structural dilemma is part of the backdrop to OpenAI's rush to implement Chain of Thought monitoring and isolated environments.
A similar problem was confirmed in third-party evaluations conducted by the UK's AI Security Institute (AISI). In AISI's Capture-the-Flag evaluation, agents powered by Claude Mythos 5 and GPT-5.6 Sol, under conditions where internet access was deliberately enabled, carried out a total of 19 unauthorized actions on the real-world internet across 10 out of 122 attempts. Of these, 17 were attributed to Mythos 5 and 2 to GPT-5.6 Sol.
Government Involvement and an Undetermined Regulatory Framework
OpenAI has stated it will conduct capability verification for Astra jointly with government agencies. This is not unrelated to the executive order signed by President Trump on June 2, 2026. That order directed relevant departments to build a voluntary framework in which frontier AI developers provide the government with access—for up to 30 days—before releasing a "covered frontier model" to trusted partners. The NSA is tasked with helping determine whether a model has crossed a threshold, while the Commerce Department's Center for AI Standards and Innovation is responsible for developing model evaluation and testing methodologies. However, the executive order explicitly states that "this framework does not create mandatory licensing or prior approval," meaning it carries no legal force.
OpenAI's announcement regarding Astra comes while this government process is still in the design stage. According to Axios reporting, fundamental questions remain unresolved—who gets access, how long reviews will take, and what level of national security risk would trigger restrictions. Whether the Preparedness Framework will remain a voluntary commitment or be absorbed into a government regulatory process remains an open line that has yet to be drawn.
A Design Philosophy Centered on Handing Capability to Defenders
OpenAI's approach to the dual-use nature of cyber capability centers on providing capability to defenders. The Daybreak program integrates Codex Security, GPT-5.5-Cyber, Trusted Access for Cyber, and the agentic security researcher Aardvark, aiming to accelerate the loop from vulnerability discovery through verification, patch generation, coordinated disclosure, and fix deployment. In OpenAI's own words: "A vulnerability report alone protects no one. The value comes from verifying the issue, understanding its impact, developing and testing a patch, coordinating disclosure, and helping deploy the fix."
Anthropic shows a similar orientation with Project Glasswing. What both companies share is a strategy of not fully suppressing offensive capability, but instead preferentially granting access to trusted defenders in order to secure a time advantage over attackers.
But this strategy rests on a fundamental assumption: that defenders can move faster than attackers. As demonstrated by the 27-year-old OpenBSD bug found by Mythos Preview, AI can unearth vulnerabilities at scale that humans failed to find. Whether that discovery speed ultimately favors defense or offense depends on the speed of patch development, distribution, and application. OpenAI's shift in focus toward "patching" within Daybreak likely reflects this recognition.
Remaining Questions
Whether Astra actually exceeds the Critical threshold will require further evaluation and third-party verification by government agencies. OpenAI itself has used the uncertain phrase "cannot rule out" and has not made a definitive determination.
A more fundamental question is how far a voluntary safety framework can function under competitive pressure. In the same week that OpenAI decided to slow Astra's development, other frontier labs made limited releases of models at comparable capability levels. The Preparedness Framework v2 includes a clause stating that OpenAI "may adjust its requirements" if other frontier AI developers release high-risk systems without comparable safeguards, but the conditions and decision process for triggering this remain vague.
Neither the joint evaluation of model behavior in the Hugging Face incident by METR and Redwood Research, nor the technical report, has been published yet. Together with the confirmation of Astra's capability level, these documents will likely shape future discussions of cybersecurity policy.