OpenAI has released a model it says can find and exploit zero-days on its own
OpenAI has released a model it says can find and exploit zero-days on its own Photograph: (AFP)
OpenAI has launched GPT-6 Astra and simultaneously classified it as ‘Critical’ for cybersecurity under its own Preparedness Framework — the first model to cross that line. In testing without safeguards it scored 100 per cent on ExploitBench and discovered two previously unknown vulnerabilities, which OpenAI says it is now disclosing to the affected vendors.
OpenAI has released GPT-6 Astra alongside an unusual admission: by the company's own measure, the model is dangerous enough to require restrictions it has never imposed before.
Astra is the first model OpenAI has designated 'Critical' for cybersecurity under its Preparedness Framework, the internal system the company uses to grade how much damage its models could do.
What The Rating Means
The Critical threshold is not a vague warning. Under OpenAI's published definition, a model reaches it if it can identify and develop working zero-day exploits across severity levels in many hardened real-world systems without a human directing each step — or devise and carry out novel end-to-end cyberattacks against hardened targets when given only a high-level goal.
OpenAI's finding is that Astra can do this. Not that it might eventually, or that a determined user could coax it into trying.
The Test That Produced The Number
Trending Stories
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
&im=FitAndFill=(700,400))
)
&im=FitAndFill=(700,400))
&im=FitAndFill=(700,400))
)
The most striking result is also the most carefully designed.
A model trained on public security data can appear to discover vulnerabilities when it is really reciting them. To control for that, OpenAI tested Astra against vulnerabilities disclosed only in the three months before launch — material the model could not have memorised.
It found two previously unknown vulnerabilities during that test. OpenAI says it is disclosing both to the software makers involved.
Stripped of its production safeguards, the model scored 100 per cent on ExploitBench, against 78.5 per cent for its predecessor GPT-5.6 Sol. On ExploitGym it reached 42.4 per cent against Sol's 30.3 per cent.
The perfect score is the headline, but the ExploitGym figure may matter more: it suggests the harder benchmark is now the one with room left in it.
How OpenAI Is Handling It
Access is deliberately awkward.
Astra is going first to a limited set of organisations before reaching ChatGPT Plus, Pro, Business and Enterprise users. For enterprise workspaces it is off by default, and an administrator has to switch it on by hand — a small piece of friction that assumes some customers would rather not have it available at all.
The public version refuses advanced offensive requests, including generating proof-of-concept exploits. OpenAI has said it intends to relax those limits for vetted defenders through a programme it is calling Daybreak.
The Tension In That Plan
Daybreak is where the reasoning gets harder to follow.
The case for it is real: defenders are outnumbered, and a tool that finds flaws before attackers do is worth having on the right side. The case against is that 'vetted defender' is a category defined by an application form, and the capability being handed over is the one OpenAI has just classified as Critical.
The model was also pre-trained on more than 100,000 GPUs at Stargate, which is worth noting for a simple reason: the capability did not arrive through a clever safety-relevant breakthrough. It arrived through scale, which means it is reproducible by anyone with comparable compute.
What To Watch
Whether the two disclosed vulnerabilities are patched before details circulate. Whether other labs now run the same benchmarks and publish results, or quietly decline to. And whether the Critical designation carries any regulatory consequence — because at present, the only body that decided this model crosses a dangerous threshold is the company that built it and shipped it anyway.
