OpenAI's Astra Can Hack Systems on Its Own, Company Says

OpenAI says its next model, Astra, is the first of its systems to cross what the company calls a "Critical" cybersecurity capability threshold under its Preparedness Framework: the ability to find and build working exploits for unknown vulnerabilities in hardened, real-world systems without a human directing it step by step.

In testing, Astra achieved a perfect score on ExploitBench, an industry benchmark that measures an AI model's ability to exploit known vulnerabilities. In a separate custom evaluation, the model discovered and chained together two previously unknown zero-day vulnerabilities on its own; OpenAI says it is now in the process of disclosing those flaws to the affected software maintainers. Compared with OpenAI's earlier GPT-5.6 Sol model, Astra is both more capable at finding and developing exploits and more efficient at doing so.

OpenAI said it is pairing the release with tighter safeguards, including improved abuse-detection and jailbreak-prevention systems, chain-of-thought monitoring meant to catch bad behavior before it happens, and account-level restrictions that limit high-risk users' access to the model's strongest capabilities. During testing, the company also checked whether Astra would try to escape its evaluation environment the way a rogue agent did in an earlier incident involving Hugging Face; OpenAI said it did not attempt to do so. Independent security researcher Yona Shavit said it remains an open question whether Astra's cooperative behavior in safety tests reflects genuine alignment or the model recognizing it is being evaluated.

OpenAI said it plans to make Astra available soon, but access to its most advanced offensive-security capabilities will be restricted to a small group of vetted "alpha testers," including US government bodies and companies enrolled in OpenAI's trusted-access program for defending critical infrastructure. The company said it will publish additional evaluation results and safety documentation when Astra becomes broadly available.

Disclosure: NewUJ's editorial process uses Anthropic's Claude models.