What happened
OpenAI shipped GPT-6 Astra on September 3, 2026. In the accompanying safety documentation, the company disclosed that Astra is the first model to reach its internal "Critical" cybersecurity capability threshold.
What "Critical" actually means
OpenAI uses tiered capability thresholds to describe how dangerous a model could be in the hands of a malicious actor. The Critical tier is the highest defined threshold. A model at Critical can, with appropriate tool access, find previously unknown security flaws and develop novel exploits across well-hardened systems without requiring a person to guide each step.
During internal testing, Astra scored 100% on OpenAI's exploit development benchmarks and discovered two previously unknown zero-day vulnerabilities without human direction. With appropriate tool access, the model can autonomously find unknown security flaws and develop novel exploits across hardened systems.
Who can access it
Access to Astra's offensive cyber capabilities is gated through Daybreak, OpenAI's application-based cybersecurity program. OpenAI added additional safeguards following a breach at Hugging Face earlier this year. The company states that current measures sufficiently minimize the risk of severe harm for release. The model is rolling out in phases, with Daybreak participants first.
What this changes for security teams
This is not a future risk. It is a current-day capability. The threshold has been crossed by a deployed model, not a research prototype. Three things security teams should act on now:
Update your threat model. Assume adversaries with frontier model access can now assist in zero-day discovery and exploit development at a level previously limited to well-resourced nation-state red teams. AI-assisted offensive capability is now a current threat, not an emerging trend.
Reconsider red team and penetration test scope. If the bar for discovering unknown vulnerabilities has dropped significantly, the bar for a thorough external assessment has risen. Engagements relying primarily on tool-based scanning and known-CVE exploitation may be leaving meaningful coverage gaps.
Watch downstream access. OpenAI is gating access through Daybreak, but the pattern of capability proliferation this year shows that containment is time-limited. The BlueMoon Chrome exploit kit spread from APT31 to three additional espionage groups within days of its first confirmed use. Track what gets built on top of frontier offensive models.
The bigger picture
GPT-6 Astra is the clearest demonstration yet that the line between AI research and AI-enabled offensive operations has blurred to the point of practical irrelevance. Security practitioners who track threat actor tooling need to add frontier AI model access to their capability assessments, alongside exploit kit availability and zero-day markets. The question is no longer whether AI will be used offensively. It is who has access and what access controls hold under pressure.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss how autonomous AI offensive capabilities change your threat model.