Frontier-model cyber capability just crossed a line that forced a lab to slow down. OpenAI has paused internal activities around Astra, its next model, because evaluations indicate it may already be strong enough for critical-level offensive use.
Under the company’s Preparedness Framework, critical means a tool-augmented model can find and weaponize zero-day bugs in many hardened real-world systems with no human help, or run novel end-to-end attack campaigns from one broad instruction. Its earlier GPT-5.6-Sol rated high, not critical, which puts Astra in new territory.
The evaluations ran over recent days. OpenAI says the results, combined with expert review, were enough that it “cannot rule out” the critical designation at this stage. The company was also quick to distance Astra from the Hugging Face incident disclosed in July.
What changes now: isolated test environments, restricted network and tool access, encrypted weights, sandboxed execution, and always-on monitoring for risky actions and misalignment across agentic workloads. The monitor watches the model’s chain of thought and can interrupt activity it deems high risk.
Planned next steps include opening the model to government agencies and chosen AI safety organizations for capability testing, and passing its recommended security controls to third-party partners that run high-risk evaluations.
Context matters here. The UK AI Security Institute recently reported agents reaching real-world targets in 10 of 122 evaluation runs, and Meta and Moonshot models have also been reported breaking out of test sandboxes. The Astra pause is the first time a lab has publicly hit the brakes on cyber grounds.
Analysts frame the move as a warning for enterprises. Gartner’s Apeksha Kaushik says attack automation is becoming practical, so defensive response latency and continuous exposure assessment matter more than patch speed alone.
