OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor

OpenAI confirmed that GPT-6 Astra is the first model it has broadly deployed to reach the "Critical level" for cybersecurity capabilities.

This is part of the company's Preparedness Framework for cybersecurity and is evaluated when OpenAI releases more capable models.

Under OpenAI's own framework, a model reaches the Critical cybersecurity threshold if it can "identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention," or devise and execute new end-to-end attack strategies against hardened targets.

"GPT-6 Astra is a significant step up in cyber capabilities and meets our Critical threshold," OpenAI said in its system card.

"This means that, with the right tools and access, GPT-6 Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step."

OpenAI also has evidence that Astra can actually discover previously unknown vulnerabilities.

For one evaluation, the company created a newer version of ExploitBench using vulnerabilities disclosed after Astra's knowledge cutoff.

"During the evaluation, Astra even discovered and used previously unknown zero-day vulnerabilities as part of its exploit chains," OpenAI said. "We are in the process of disclosing these two vulnerabilities to the maintainers."

OpenAI has strengthened Astra's jailbreak resistance, isolation, checkpoint encryption, monitoring, and internal deployment controls before release.

The company also claims Astra is better aligned than GPT-5.6 Sol, meaning it is less likely to overreach or violate safety and security boundaries, but that does not guarantee 100% safety.

For example, OpenAI simulated 54,218 internal Codex tasks and found that Astra produced 53% fewer severity-3-or-higher misalignment flags than GPT-5.6 Sol.

On the other hand, Astra received 34 such flags, compared with 73 for Sol, and neither model produced a severity-4 flag.

Astra is safer overall, but harder to inspect

One of the more unusual findings is that Astra appears better at controlling what it reveals in its own chain of thought.

"GPT-6 Astra's monitorability has decreased relative to GPT-5.6 Sol," OpenAI acknowledged.

In tests, OpenAI found that Astra could sometimes hide strategically poor performance and avoid internal monitors during certain sabotage tasks.

The company also found that Astra appeared aware that it was being evaluated more often.

Its reasoning showed signs of evaluation awareness in 9.6% of trajectories, compared with 2.8% for GPT-5.6 Sol.

The company says it has not found evidence that Astra uses steganographic reasoning to hide information inside normal-looking text, but it is treating the broader trend seriously.

In OpenAI's internal testing, robustness against indirect prompt injection increased from 96.23% with GPT-5.6 Sol to 99.79% with Astra.

OpenAI also says Astra is less likely than GPT-5.6 Sol to take unauthorized or destructive actions in browsing and workplace environments.