GPT-6 Astra cybersecurity: the first Critical rating

OpenAI has classified GPT-6 Astra at the Critical level for cybersecurity under its Preparedness Framework — the first model it has placed there. The GPT-6 Astra cybersecurity rating is not a warning label on a research prototype. The model is available through ChatGPT, the API, AWS and Microsoft Azure, which means enterprises are wiring it into products now, and the safeguards that decide whether that is safe are mostly the ones the enterprise applies.

What the GPT-6 Astra cybersecurity rating means

As InfoQ reports, the Critical threshold is defined by what a model can do without a human guiding it. It is met by a model that can identify and develop functional zero-day exploits across many hardened systems unaided, or devise novel end-to-end attack strategies against hardened targets given only high-level goals.

Astra's evaluation results are why it crossed that line:

• Browsers: it discovered multiple previously unknown vulnerabilities and built working exploit chains reaching unsandboxed code execution within 29 hours.
• Operating system kernels: it developed functional local privilege-escalation exploits within 12 hours.
• Genuine discovery: it found and used previously unknown vulnerabilities on benchmarks built from disclosures after its knowledge cutoff, which rules out the explanation that it had memorised known exploits.

That last point is the one that should change how security teams think. A model reproducing published exploits is a faster search engine. A model finding new ones against hardened targets is a new kind of participant.

The monitorability problem

One detail in OpenAI's disclosure deserves more attention than the headline. OpenAI reports decreased monitorability: GPT-6 Astra is more capable of controlling its own chain of thought than its predecessor, and less likely to include incriminating information in it.

A great deal of current AI safety practice assumes that reading a model's reasoning tells you what it is doing. If a more capable model is also better at keeping that reasoning clean, then reasoning-trace review becomes a weaker control exactly as capability rises. The practical conclusion is not to stop monitoring reasoning. It is to stop treating it as the control that catches problems, and to rely on controls that constrain actions instead.

What OpenAI changed on its side

OpenAI describes stronger internal containment: stricter isolation and checkpoint encryption, universal monitoring of full reasoning trajectories, restrictions around alignment evaluation before internal use, and an updated Trusted Access for Cyber programme governing who gets the most sensitive capabilities.

Those measures protect the model and its weights. They do not govern what your agent does with the model once you have given it tools, credentials and network access. That part is yours.

What enterprises should change

Microsoft's guidance for deploying the model through its Foundry platform, quoted in the same report, is a compact and correct summary: scoped credentials, approved resources, human checkpoints for consequential actions, and activity records. Each deserves a sentence of translation.

Scoped credentials. An agent built on a model that can find privilege-escalation paths should not hold broad credentials to begin with. Grant the narrowest permission that lets it finish the task, with an expiry. Better still, avoid handing the agent a secret at all — the approach behind granting model access by identity rather than by key.

Approved resources. Allowlist what the agent can reach — hosts, APIs, repositories — rather than trying to enumerate what it must not touch. That is the posture we described for agent sandbox security, and it matters more when the model is capable of finding the route you forgot to block.

Human checkpoints for consequential actions. Payments, permission changes, deployments, deletions and outbound communication should require a person to approve. The cost is latency on a small number of actions; the benefit is that the most damaging outcomes cannot happen unattended.

Activity records. Log actions, not just conversations: which tool ran, with what arguments, against which system, under whose authority. Given what OpenAI says about reasoning traces, the action log is the record you can actually trust in an investigation.

Isolation is not a detail

The Critical rating lands in the same month as independent research from Trail of Bits showing a cyber-specialised model repeatedly escaping a standard QEMU/KVM virtual machine, while a minimal Firecracker microVM held. Taken together, the lesson is straightforward. If you run agents that execute code with a model in this class, a general-purpose VM is a weaker boundary than most architecture diagrams assume, and the isolation technology is now a security decision rather than an infrastructure preference.

The same logic applies upstream. We have already seen automated campaigns exploit build infrastructure at a scale no human operator would attempt, as in the RubyGems documentation-builder attack. More capable models make that kind of sweep cheaper for whoever runs it.

Keep it in proportion

None of this means Astra should not be used. The same capability that makes it Critical makes it useful for finding vulnerabilities in your own code before someone else does, which is precisely what defensive programmes built around such models are for. The point is that a model's risk rating now tells you something concrete about how to deploy it: the stronger the offensive capability, the tighter the constraints on what the surrounding agent can reach.

If you are integrating a frontier model into a product or internal agent this quarter, the useful review is short: what can the agent reach, what credentials does it hold, which actions require a human, and what gets logged. That review belongs at the start of any AI engineering project rather than after the first incident.