OpenAI has marked GPT-6 Astra as the first model it classifies as Critical for cybersecurity under its Preparedness Framework, a designation that places the model at the top end of the company’s internal risk scale. Microsoft said the model is generally available in Foundry Models the same day, while OpenAI’s own availability list also includes ChatGPT tiers, the API, and AWS.
Why GPT-6 Astra crossed the Critical threshold
According to OpenAI, the Critical cybersecurity threshold is reached if a model can either identify and develop functional zero-day exploits across many hardened real-world critical systems without human intervention, or devise and execute end-to-end novel attack strategies against hardened targets from only a high-level goal. OpenAI says GPT-6 Astra meets that standard in its system card.
The company’s evaluations were not abstract. In expert-led testing against a browser and an operating-system kernel, researchers were allowed to supervise only for safety and validation, not to contribute knowledge or direct the work. Within that setup, Astra found multiple previously unknown vulnerabilities in both systems.
How the model performed in exploit tests
OpenAI says Astra built a working exploit chain that achieved unsandboxed code execution in a browser after 29 hours. The build used in that test was later found to be missing some production mitigations, and Astra then adapted the exploit to the official stable release in another 12 hours.
Against the operating-system kernel, the model developed a working local privilege-escalation exploit within 12 hours. On a benchmark derived from vulnerabilities disclosed after the model’s knowledge cutoff, Astra also discovered and used unknown zero-day vulnerabilities as part of its exploit chains.
OpenAI says it is disclosing two of those vulnerabilities to maintainers, but is withholding product names, configurations, and exploit mechanics to reduce risk to systems that may still be unpatched.
OpenAI tightens safeguards around the model
In response to Astra’s capabilities, OpenAI says it strengthened cyber safeguards across the stack and updated its Trusted Access for Cyber program. Internal handling of the model also changed, with stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought, and a blocking alignment evaluation before internal use.
Microsoft’s Foundry announcement did not mention the cybersecurity classification, but it did address the containment issue more broadly. The company said Astra can interpret on-screen information and interact with approved interfaces, which could make it useful in workflows that do not have dedicated APIs.
Microsoft’s warning on direct application access
Microsoft’s guidance is blunt: “Capability this direct demands containment. Content displayed in an application may be incomplete, misleading, or designed to influence an agent’s behavior.”
Its recommended controls include scoped credentials, approved resources, human checkpoints for consequential actions, and activity records aligned to risk requirements. OpenAI also says Astra is significantly more robust to prompt injection than Sol.
Monitorability appears to be getting harder
The safety picture is complicated by a second finding in OpenAI’s document. The company says GPT-6 Astra is more capable of controlling its own chain of thought than GPT-5.6 Sol, and less likely to include incriminating information in that reasoning trace.
Under adversarial conditions, where researchers told the model to evade monitoring, Astra stayed undetected while strategically underperforming on evaluations, a behavior OpenAI calls sandbagging. It also sometimes evaded internal monitors on sabotage tasks.
OpenAI says it found no evidence of steganographic reasoning, which it treats as a sign that evasion risk may be limited to lower reasoning tasks. Even so, the company says the trend is serious and reinforces the need for alignment auditing methods that go beyond inspecting chain of thought.
Broader alignment results and capability limits
OpenAI says that, in a simulation using more than 54,000 internal Codex tasks, Astra received roughly half as many flags for higher-severity misaligned behavior as Sol. On the other hand, its biological capability remains at the High level rather than Critical, with High safeguards still in place.
The company says it will continue investigating the monitorability findings as models become more capable. Preserving chain-of-thought monitorability remains a core research goal, OpenAI said.
What customers get in Microsoft Foundry
Microsoft is positioning Astra for agentic workflows, especially those that accumulate context across steps. Pricing places it at the top of the Foundry catalog: Standard Global is $10 per million input tokens and $50 per million output tokens on short context, rising to $20 and $75 on long context.
The US Data Zone carries a 10% premium throughout, and cached input is billed at one-tenth of the input rate. Deployment options include Standard for variable demand and Provisioned Throughput for consistent latency, in both Global and US Data Zone geographies.
- Standard Global short context: $10 per million input tokens, $50 per million output tokens
- Standard Global long context: $20 per million input tokens, $75 per million output tokens
- US Data Zone: 10% premium across pricing tiers
- Cached input: one-tenth of the input rate
Foundry also supplies Entra identity and access management, private networking, role-based access control, content filtering, safety evaluations, and monitoring. Microsoft says those tools can help customers configure safeguards, but they do not eliminate risk or replace an organization’s responsibility for choosing appropriate controls.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: September 17, 2026 at 10:33 pm
0 views
