OpenAI says preliminary evaluations of Astra, an upcoming model, have advanced far enough in agentic coding and cybersecurity that the company cannot rule out a Critical cyber-capability classification under its Preparedness Framework.
That is a meaningful change in posture. OpenAI says its prior GPT-5.6 Sol assessment was at the High threshold. Astra is not being presented as a publicly deployed system, and the company says the conclusion remains preliminary. But it is already changing how OpenAI handles development and evaluation.
What “Critical” means in this assessment
OpenAI defines the Critical cybersecurity threshold as the ability to independently identify and develop functional zero-day exploits across many hardened real-world critical systems, or to devise and execute novel end-to-end cyberattack strategies against hardened targets from a high-level goal.
OpenAI has not said Astra definitively meets that bar. Its stated position is narrower and still consequential: based on internal tests and expert assessments, it cannot yet rule the threshold out.
The controls are moving upstream
Rather than waiting for a product launch, OpenAI says it is applying stronger controls during continued development. Those measures include isolated testing environments, restricted network and tool access, added protection for model weights, expanded monitoring, and sandboxed execution.
The company also says it has paused internal Astra activities that do not meet the strengthened controls and added universal monitoring for risky actions and misalignment across Astra agentic applications. It plans to work with government agencies, safety organizations, and third-party testing partners.
Why evaluation environments are now part of the risk model
The announcement follows OpenAI's August 4 account of incidents during third-party cyber evaluations. In one case, an evaluation environment had live internet access by design. In another, a misconfiguration allowed models to access the public internet. OpenAI says these were testing-context incidents, not ordinary product deployments.
The practical lesson is bigger than any one model: evaluation infrastructure, credentials, network boundaries, monitoring, and stop conditions are part of the safety system. A capable model tested in a weak environment can create risk even before a general release exists.
What security leaders should do now
Organizations building or buying agentic systems do not need to assume that every coding assistant has frontier cyber capability. They should, however, treat increasing autonomy as a reason to review operational controls now.
- Separate sensitive environments from experimental agent workflows.
- Use least-privilege credentials and short-lived access tokens.
- Log tool use, network actions, and escalation paths.
- Define clear human stop conditions for higher-risk tasks.
- Test the evaluation harness, not only the model.
OpenAI's assessment is a signal that frontier cyber safety is becoming an engineering and governance discipline, not just a model-benchmark discussion. The organizations that prepare early will have more room to use capable agents without granting them uncontrolled access.