# How OpenAI Decided Astra Was Too Dangerous to Ship Open: Capability Thresholds, Explained > Source: > Published: 2026-09-18 06:43:37+00:00 When GPT-6 Astra shipped on September 3, the headline was that OpenAI rated it **Critical** for cybersecurity, the first time it has ever given a model that rating, and chose to gate the dangerous capability rather than release it openly. A lot of coverage treated "Critical" as a vibe. It is not. It is the output of a structured process for deciding when a model is too dangerous to ship as-is, and understanding that process is genuinely useful, because this kind of capability-gating is going to become normal and you will keep seeing these ratings. Here is how it actually works, in plain terms. The framework OpenAI and other labs use does not ask the vague question "is this model safe." It asks a sharper one: "does this model cross a defined capability threshold in a domain we consider dangerous." Cybersecurity is one such domain (others include things like bio and autonomy). Each domain has tiers, roughly escalating from low to high to critical, defined by what the model can *do*, not how it feels. So "Critical for cybersecurity" is not a mood. It is a claim that the model crossed a specific, pre-defined capability line, in this case, the ability to autonomously find zero-day vulnerabilities in hardened systems and turn them into working exploits without human guidance. That is a bright-line capability, and the model reportedly cleared it. The point of defining thresholds in advance is that crossing one is supposed to *force* a response, before the model ships, not after something goes wrong. That is exactly what played out with Astra: The sequence is the whole value of the framework: define the dangerous line ahead of time, evaluate against it honestly, and let crossing it mandate specific safeguards. Without pre-defined thresholds, "is it too dangerous" becomes a judgment call made under launch pressure, which is exactly when you do not want to be inventing the standard. Rating a capability Critical does not automatically mean "do not ship." It means "do not ship *this capability* openly." Astra's general intelligence is available; the zero-day capability ships behind split, controlled access. This is the framework working as intended: it separates the dangerous slice from the useful whole and applies controls proportional to the risk, rather than the blunt choice of ban-it-all or ship-it-all. You are not running these evaluations. So why care? Two reasons that are directly practical: "Critical for cybersecurity" is not a marketing adjective, it is the result of a defined process: name the dangerous capabilities in advance, set thresholds, evaluate honestly, and let crossing a line force specific safeguards, up to and including gating the capability away from open release. Astra is the first model to trip the cyber threshold, and watching how OpenAI handled it, pause, mitigate, resume, ship gated, is a preview of how capable-but-dangerous AI gets released from here. It is also a template for the governance your own organization will need the day it puts a capable model near anything that matters. Does your organization have any pre-defined line for what an AI system is allowed to do before a human has to step in, or is it still decided case by case under pressure? That "we'll know it when we see it" gap is exactly what capability thresholds are meant to close.