OpenAI’s newest model found two zero-day vulnerabilities, chained them into a working exploit, and broke into a hardened system on its own.
The model is Astra. On September 1, 2026, OpenAI confirmed that it’s the first model to cross the “Critical” cybersecurity threshold under its own Preparedness Framework, the level at which a model can find and build zero-day exploits, or work out an entire attack strategy, without a human walking it through. Astra already scored 100% on ExploitBench, which measures whether a model can build exploits from known vulnerabilities. Now it finds the unknown ones too and turns them into attack chains independently.
A model that can hunt down vulnerabilities on its own doesn’t stay inside OpenAI’s test environment. It changes what “attack surface” means for every team running AI in production.
What Astra does #
Give Astra a high-level goal and it works out the attack strategy end to end. It finds flaws nobody has cataloged, writes working exploits, and does it using fewer tokens and a much higher code-execution success rate than GPT-5.6 Sol.
The two-zero-day chain came from a single internal test. A good human red team would have burned days, maybe weeks, getting to the same place.
Astra also refuses cyber-jailbreak attempts 91.5% of the time. GPT-5.6 Sol only managed 59%. Capability and restraint improved in the same release.
Why “Critical” is the label to pay attention to #
Crossing this threshold obligates OpenAI to ship controls: tighter alignment training, chain-of-thought monitoring to catch the model reasoning its way around a rule, refusals trained in after the fact, classifiers watching for misuse, extra scrutiny on accounts that look off. Access is restricted, starting with a small alpha and a restricted “Daybreak Blue” track reserved for people doing defensive security work.
OpenAI also says its own monitoring will sometimes flag legitimate security work as misuse. If the lab that built the thing needs that much scaffolding, one guardrail on your end isn’t enough.
The pace problem #
On an internal ExploitBench port built from vulnerabilities disclosed between June and August 2026, Astra’s success rate climbed to roughly 39% within about 75,000 output tokens. GPT-5.6 Sol needed nearly double that token budget just to crack 11%.
OpenAI deployed its first High-capability cyber model in February. Astra hit Critical seven months later. I wouldn’t bet on this slowing down. Those Astra numbers are from the restricted Daybreak Blue tier; most people won’t get anywhere near that.
The gap this leaves for everyone else #
Most companies shipping AI don’t have a Preparedness Framework or a team reading a model’s chain of thought. What they do have is a security review cycle built for a slower era, and releases shipping faster than those reviews can finish.
The people building the next round of attack tooling have none of OpenAI’s constraints, and they now know autonomous zero-day discovery works. Your last pentest tested a threat model that no longer exists.
What closes the gap #
OpenAI didn’t bet on a single control for Astra, and neither should you. Anaconda’s approach to red teaming: an Attacker AI keeps generating new adversarial prompts, an Evaluator AI grades what comes back, and the cycle repeats. It covers more than 300 risk categories across security, safety, and brand, mapped against NIST AI 600, the OWASP Top 10 for LLMs, and MITRE ATLAS.
Pre-launch testing isn’t enough; you still need guardrails in production, catching what red teaming missed and adapting as new attack patterns surface, plus monitoring that continues after launch day.
Testing finds the holes and guardrails catch what slips through. But neither one touches what the model is capable of in the first place. That gets locked in during training, long before anyone runs a red team against it. That’s the harder problem, and it’s why we’re working directly with frontier labs on alignment and safety controls.
The takeaway #
Astra is a preview of where this is headed. Offensive capability is outpacing what most security programs were built to handle, and the labs building these models are telling us as much through the safeguards they shipped.
Red team before you deploy. Add guardrails at runtime. Continuously monitor. And if the last time you checked your AI’s security predates September 1st, you’re already behind.
See how automated guardrails catch what a one-time review misses—>