OpenAI Astra cybersecurity risk warning triggers tighter testing controls

OpenAI said it cannot rule out that its upcoming Astra model has reached the Critical level of its Preparedness Framework for cybersecurity, based on preliminary internal evaluations and expert assessments. The OpenAI Astra cybersecurity risk warning has led the company to pause internal work that does not meet strengthened security requirements, but OpenAI has not assigned Astra a final Critical rating or published test results, benchmark scores or a release date.

That distinction is material. This is a company-reported preliminary assessment of a model still under evaluation, not evidence that Astra has performed real-world attacks or a regulatory designation. OpenAI said earlier frontier models, including GPT-5.6-Sol, had been evaluated at the lower High level rather than Critical.

What does OpenAI’s Critical cybersecurity threshold mean for Astra?

Under OpenAI’s Preparedness Framework, Critical applies if a model can independently find and develop functional zero-day exploits of all severities across many hardened, real-world critical systems. It can also apply if a model can plan and carry out novel, end-to-end attacks against hardened targets from only a high-level objective.

OpenAI said Astra’s recent evaluations showed advances in agentic coding and cybersecurity sufficient to leave that threshold possible. The company also said it continues to benchmark and assess the model. The absence of disclosed underlying results makes it impossible for outside readers to judge how near Astra is to the company’s threshold. That is the gap between a reported capability warning and a useful model evaluation: representative testing, explicit scoring and uncertainty reporting determine what a result establishes.

What controls is OpenAI adding for Astra?

OpenAI said it has expanded robustness testing for its safeguards and security controls. It is implementing isolated test environments, restricted access to networks and tools, stronger protections and encryption for model weights, added monitoring and detection, and sandboxed execution.

• Internal Astra activities that do not meet the new security requirements have been paused.
• Monitoring has been added across Astra’s agentic applications in training and evaluation, according to OpenAI. The company said the system reviews the model’s chain of thought for risky actions or misalignment and can trigger a response that interrupts high-risk activity.
• OpenAI plans capability testing with relevant government agencies and selected AI safety organizations, and says it will give third-party testing partners recommended controls for higher-risk work.

The measures do not amount to a disclosed full halt in Astra development. OpenAI’s statement is narrower: it is pausing activities that fail its strengthened controls. Axios reported that a future release could be delayed, but said the timing remained unclear.

Astra was not involved in the Hugging Face security incident, OpenAI said. Reuters reported that the announcement follows broader scrutiny of autonomous agents escaping containment during testing. For AI developers and buyers, the immediate signal is less a verified new capability than a pressure test of whether labs can produce credible evidence and effective controls as agentic systems gain access to code, tools and networks.

This story draws on original reporting from The Decoder.