# OpenAI’s GPT-6 Astra becomes its first model rated Critical for cybersecurity > Source: > Published: 2026-11-12 18:48:26+00:00 # OpenAI’s GPT-6 Astra becomes its first model rated Critical for cybersecurity OpenAI official logo (public domain, Wikimedia Commons) — CryptoBriefing brand treatment A companion model, GPT-6 Cyber, is already working with security teams at Mozilla, Palo Alto Networks, and Cisco [OpenAI](https://cryptobriefing.com/markets/openai/) says its new GPT-6 Astra model has crossed the “Critical” cybersecurity capability threshold under the company’s Preparedness Framework. It is the first model in OpenAI’s lineup to earn that rating. Alongside Astra, the company has a specialized sibling called GPT-6 Cyber. OpenAI says it is serving security teams at Mozilla, Palo Alto Networks, and [Cisco](https://cryptobriefing.com/markets/cisco/). ## What Astra can actually do According to the research findings, GPT-6 Astra can autonomously find and exploit zero-day vulnerabilities across complex systems. The model can also build full cyberattack plans starting from high-level goals. On the ExploitBench evaluation, Astra posted a score of 100%. Its predecessor, GPT-5.6 Sol, scored 78.5% on the same test. OpenAI’s internal testing ran from September 1-4, 2026. During that window, Astra turned up two zero-day vulnerabilities that were previously unknown. Those two flaws will be disclosed to the maintainers of the affected software, according to the findings. ## GPT-6 Cyber goes to work OpenAI released GPT-6 Cyber on November 5, 2026. It is a specialized variant built for controlled vulnerability research and exploit validation. ### AI, tech, and the markets they move—in one daily briefing. Daily. Free. Join 34,000+ readers across crypto, finance, and policy. Access is limited to vetted customers only. On the ExploitGym benchmark, GPT-6 Cyber scored 48.5%. The previous version, GPT-5.6 Cyber, scored 32.1%. The research team reported finding 81 previously unknown high-severity vulnerabilities in Firefox. The team also reported developing working exploits for 948 Linux kernel privilege escalations, with 588 of those being new. Mozilla credited OpenAI in its Firefox 159 security advisory for the vulnerabilities found. Lee Klarich, who serves as CPO and CTO of Palo Alto Networks, praised the model’s effectiveness for defensive work. Mozilla engineer Brian Grinstead did the same. ## Why the Critical rating matters OpenAI’s Preparedness Framework is the company’s internal system for grading how dangerous a model’s capabilities could be in sensitive areas. Cybersecurity is one of those areas. Reaching “Critical” means OpenAI itself judges Astra’s abilities to be at the top of its risk scale. OpenAI’s answer, at least for the Cyber variant, appears to be gatekeeping. Restricting access to vetted customers and routing discoveries through responsible disclosure is how the company is trying to keep the defensive upside while limiting the offensive downside. **Disclosure:** This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/).