GPT-6 Astra Cybersecurity: First AI Rated Critical

Key takeaways

• GPT-6 Astra's cybersecurity capability was publicly rated "Critical" under OpenAI's Preparedness Framework at release on September 3, 2026, the first commercially available model to carry that rating.

• On the public suite, Astra scored 100% on ExploitBench, 39.0% on its refreshed June–August 2026 port, 88.0% on SRE-Bench, 85.4% on SEC-Bench Pro, and 42.4% on ExploitGym.

• During internal testing, Astra achieved arbitrary code execution against two undisclosed zero-day vulnerabilities, an uplift over GPT-5.6 Sol that OpenAI documented in the System Card.

• ENISA has begun formal testing of Astra and Anthropic's Mythos-tier model under the EU AI Act. The outcome is expected to inform provider obligations and, potentially, enterprise access controls beyond the EU.

• For CISOs, the practical work this quarter is a targeted threat-model refresh, red-team scoping, API-access governance, and logging, not a blanket ban.

On September 3, 2026, OpenAI shipped GPT-6 Astra carrying a label no commercial model had worn before: "Critical" on cybersecurity, the top tier of its own Preparedness Framework. That's not a marketing flourish. It's a self-classification the company is publicly committed to and, in Europe, subject to obligations under the EU AI Act, earned on benchmark suites the industry spent two years hardening against contamination.

If you run security, the GPT-6 Astra cybersecurity story matters this week, not next quarter. Whether you're a CISO, a red-team lead, or a security engineer, the real question is whether your acceptable-use policy still matches reality. What follows walks the numbers the way a practitioner needs to see them: what each benchmark actually measures, what OpenAI has said about refusal behaviour, what ENISA is now doing under the EU AI Act, and what to change in your controls before Q4 procurement cycles close.

GPT-6 Astra Cybersecurity: What the "Critical" Rating Actually Means

GPT-6 Astra is the first OpenAI model to reach the Preparedness Framework Critical threshold on cybersecurity. That's a self-classification the company defines by measured offensive-capability uplift over the prior "High" tier, and by the specific pre-launch safeguards it triggers.

Moving from "High" to "Critical" isn't a marketing gradient. Under the framework, "Critical" means the model's capability, when combined with plausible attacker workflows, materially increases the risk of real-world harm beyond what the prior tier allowed. In practice, that pulled in an extra round of red-team evaluations, deployment-time monitoring, stricter usage-policy enforcement, and pre-launch reporting to internal safety governance before Astra was cleared for API release.

How Astra compares to the current frontier

OpenAI's published comparison places Astra ahead of GPT-5.6 Sol, Claude Fable 5.1, Claude Opus 5, and Gemini 3.8 Flash across the public cybersecurity benchmarks in the release notes. Astra's absolute scores are the headline. What appears to have pushed the classification into Critical was the delta over the next-best model, particularly on the refreshed ExploitBench internal port.

That's four benchmark suites, one of which ships in two versions. For the exact competitor numbers and the evaluation methodology, the GPT-6 Astra release page and System Card are the primary source. Anyone quoting a comparative delta should link that document, not a screenshot doing the rounds on LinkedIn.

Benchmark Deep-Dive: What the Numbers Actually Mean

A 100% on ExploitBench looks alarming until you sit with what the benchmark actually is. ExploitBench draws its exploit-development tasks from publicly disclosed vulnerabilities, so a well-trained frontier model has, in principle, seen relevant fragments during pre-training. That's precisely why OpenAI runs a second version.

ExploitBench 100% vs the June–August 2026 refresh

The refreshed internal port, at 39.0% for Astra, uses vulnerabilities disclosed after the training cutoff. The 61-point gap between the two versions is the signal worth trusting. It suggests Astra performs exceptionally on tasks it has likely encountered, and materially less well, though still meaningfully, on ones it hasn't.

When you're modelling AI-assisted exploit development risk in 2026, 39.0% on novel, recently disclosed CVEs is the number to remember. It's the closest public proxy available for how the model might perform against a vulnerability disclosed tomorrow.

SRE-Bench 88.0% and SEC-Bench Pro 85.4%

These are the dual-use benchmarks. SRE-Bench tests the reasoning defenders use daily: incident triage, log interpretation, remediation planning. SEC-Bench Pro spans detection engineering, secure-code review, and configuration hardening.

Astra's scores here are why blue teams are paying attention, and the same dual-use capability is plausibly of interest to attackers. On OpenAI's published comparison, the gap Astra shows over every named competitor, including Claude Opus 5 and Gemini 3.8 Flash, is largest on the multi-step reasoning tasks inside SEC-Bench Pro.

ExploitGym 42.4%, and why the ceiling is still low

ExploitGym is the interactive benchmark. The model gets dropped into a sandboxed target, handed a goal, and told to iterate. Current frontier models generally struggle here, and Astra is no exception.

One factor is architectural: an exploitation chain against a live target can run to dozens of decision points, and small reasoning errors compound. The second is the feedback loop inside a real code environment. When a payload fails, the signal returned is often a stack trace or a segfault, and the model has to infer whether the failure is a bug in its own approach, a missing precondition, or a dead end that requires backtracking several steps. Stack the sheer step count of realistic exploitation on top of that, and the ceiling stays depressed.

42.4% is among the highest publicly reported scores as of September 2026. Reliable it isn't. That gap between benchmark ceiling and reliable operational capability is exactly the space defenders should plan around.

Retired benchmarks and the new internal evaluations

OpenAI dropped CTF (Internal) and CVE-Bench from this release. Both had become saturated or contamination-prone. In their place, the company introduced two internal benchmarks explicitly designed to avoid historical-vulnerability leakage: Sandbox Bench and the ExploitBench Internal Port.

The purpose isn't to hide the scores. It's to have something meaningful to measure on the next model, by which point today's public benchmarks may well be memorised.

Zero-Days, Arbitrary Code Execution, and Real-World Exploit Risk

According to the System Card, Astra achieved arbitrary code execution at substantially higher rates than GPT-5.6 Sol on flaws disclosed between June and August 2026, including two zero-day vulnerabilities in unspecified software. That finding appears to have been central to the Critical classification, and it's worth parsing carefully.

"Arbitrary code execution" in this context means the model, given a target and appropriate framing, produced working exploit code that ran adversary-controlled instructions on the target. Not proof-of-concept snippets. Not pseudocode. Executable payloads.

For an authorised penetration tester with a scoped engagement, that can act as a productivity multiplier. For a malicious actor with API access and enough patience to sidestep the usage policy, the same capability could shift the offence-defence economics on a specific class of vulnerability: n-day exploitation in the days immediately after disclosure, when patch coverage is uneven.

The two zero-days are the more interesting data point. OpenAI hasn't named the software involved. What matters is that the model surfaced exploitable conditions in code it had never seen a published exploit for. Sandbox Bench and the ExploitBench Internal Port are the evaluations built to catch exactly this scenario, and OpenAI reports that they surfaced the behaviour before general availability. That's what the Critical rating reflects.

One caveat belongs in every threat model: none of these benchmarks tell you the real-world uplift for a well-resourced adversary. They indicate a ceiling in a controlled setting. A skilled attacker with Astra API access isn't the same as Astra alone, and neither is the same as an unaided attacker. Uplift is the delta that actually matters, and uplift is hard to measure. For a longer read on how AI is bending the attacker-defender curve in both directions, see our companion piece.

OpenAI's Safeguards: What Astra Refuses and Why

OpenAI's stated policy on Astra is that proof-of-concept exploit development against non-authorised targets is intended to be blocked at inference. That policy is documented in the model's usage guidelines and reiterated in the "Path to Astra" safety update. Refusal is layered: prompt-time classification, in-conversation monitoring, rate limits keyed to abuse patterns, and post-hoc review of flagged sessions.

Independent probing has begun. StationX published API-call testing on September 5, 2026, running scripted refusal probes across a range of offensive-security prompt patterns. Their reported findings, and only their reported findings, are the fair reference point here. They observed consistent refusal on direct exploit requests, more variable behaviour on adjacent tasks (vulnerability analysis framed as defensive review, for instance), and degradation under multi-turn framing pressure. That last pattern isn't unique to Astra. It has been observed across current frontier models.

Layered controls also cover the account, not just the prompt. Usage-policy enforcement includes suspension for confirmed abuse, elevated logging for API tenants operating in security-adjacent categories, and, per the System Card, a review path for security-research access requests.

What OpenAI hasn't yet published, and what CISOs will reasonably want, is a granular breakdown of false-positive rates on legitimate security-research workflows. Until that data lands, security teams should anticipate some friction on defensive workloads that touch exploit-adjacent framings: CVE triage against internal codebases, purple-team scenario design, or malware family analysis for detection engineering. Build a lightweight appeal path into your tenant governance so that a genuine defensive prompt blocked at inference doesn't stall an incident response.

Regulatory Response: EU AI Act, ENISA, and the CRA

On September 10, 2026, the European Commission confirmed that ENISA's EU AI Act testing of GPT-6 Astra is under way, alongside parallel testing of Anthropic's Mythos-tier model. Both are being treated as general-purpose AI models with systemic risk under the Act. That designation carries specific obligations for providers: their own risk evaluations, adversarial testing documentation, and serious-incident reporting to the AI Office.

For a Critical-rated model, those obligations bind harder than they did for the previous generation. Providers must document capability evaluations that map to the model's public claims, and they must disclose material incidents on a defined timeline. ENISA's role isn't to reclassify the model. It's to independently verify what the provider has already claimed, and to flag gaps in the evidence.

The EU Cyber Resilience Act intersects here in a way that hasn't yet been fully worked through. The August 31, 2026 CRA explainer highlighted a live question: when an AI model can generate exploit code against a vendor's product before the vendor has patched it, who reports what, to whom, and when? "Report what it hasn't yet made you fix" isn't a rhetorical framing. It's the compliance edge case regulators are now writing guidance for. ENISA's Astra findings, expected before year-end, are likely to inform where the line lands.

One practical consequence for enterprises outside the EU: the access-control template regulators build for Astra could become a widely referenced model, in a pattern similar to how GDPR influenced data-protection practice internationally. Buyers in the US and APAC should read the ENISA output when it drops, not after. For teams building an enterprise AI policy from scratch, this is a sensible moment to align procurement to that template.

What Security Teams Should Do Right Now

Threat models built around GPT-5.6-class capabilities would benefit from a targeted refresh, not a full rewrite. Realistic elevation shows up on n-day exploitation windows, phishing infrastructure quality, and social-engineering personalisation. It's less pronounced on novel vulnerability discovery in unfamiliar codebases, where ExploitGym's 42.4% is the honest ceiling.

For red teams operating under authorised engagement, Astra-class API access is increasingly relevant to realistic adversary emulation. The playbook that made sense a year ago against a Claude Opus 5-tier attacker may no longer match what a well-tooled operator can do. Blue teams should assume the delta and plan detection accordingly, especially around post-exploitation activity that a model can generate more coherently than the previous generation.

A CISO guide: GPT-6 Astra enterprise security checklist

Before enabling Astra in enterprise environments, put these questions to the account team in writing and keep the answers:

1. Which tenant tier does our contract fall under, and what enforcement actions apply on confirmed usage-policy violations?

2. What logging is available to us, in near real time, on prompt content, tool-use invocations, and output categories?

3. What is the escalation path when our SOC observes suspected misuse from an internal user?

4. What documented refusal behaviour applies to security-research prompts submitted by our red team, and how do we register that team for elevated access?

5. Which regional data-residency options apply to prompts and outputs, and how do those interact with our own regulatory posture (EU AI Act, CRA, sectoral rules)?

6. What is the incident-notification SLA if OpenAI identifies a model-level safety incident that affects our tenant?

7. What is the deprecation timeline, and what continuity commitments apply when the model version we depend on is retired?

For deeper cost-performance context on the developer-facing side of the same lineage, see our GPT-5.6 breakdown.

Track this at primary sources, not the commentary layer: the OpenAI Deployment Safety Hub for model-level updates, ENISA advisories for EU regulatory posture, and the individual benchmark repositories for methodology changes.

Frequently Asked Questions

Is GPT-6 Astra available?

Yes. OpenAI released GPT-6 Astra on September 3, 2026, and it's available through the standard API and enterprise contracts, subject to the usage policy applied to Critical-tier models. Availability by region depends on the tenant's contract, so the enterprise product team is the right stop to confirm eligibility for your account.

What is the Preparedness Framework Critical threshold actually based on?

It rests on OpenAI's own capability evaluations: four public benchmark suites (ExploitBench, including its June–August 2026 refresh, SRE-Bench, SEC-Bench Pro, and ExploitGym) plus two internal evaluations (Sandbox Bench and the ExploitBench Internal Port) designed to measure offensive-security uplift on tasks the model hasn't seen during training. The System Card is the primary reference.

Can Astra actually write working zero-day exploits?

According to OpenAI's System Card, Astra demonstrated arbitrary code execution against two undisclosed zero-day vulnerabilities during internal evaluation. That's a capability finding under controlled conditions, not a claim about real-world availability under the usage policy. The public API is designed to block direct proof-of-concept exploit requests against non-authorised targets; refusal behaviour on adjacent framings is reported as less consistent, per independent probing published on September 5, 2026.

What does the EU AI Act require of providers now that Astra is on the market?

For general-purpose AI models with systemic risk, the Act requires providers to conduct and document capability evaluations, run adversarial testing, and report serious incidents to the AI Office on a defined timeline. ENISA has begun independent testing of Astra and Anthropic's Mythos-tier model, per the European Commission's September 10, 2026 statement.

Can you make $500,000 a year in cyber security?

Reported compensation data suggests this is achievable at senior levels, though rarely as a starting salary. Total-compensation data published shows principal-level security engineers at large tech employers reaching or exceeding that mark when equity is included, and specialist AI-security roles at frontier labs are reported at or above it. Seasoned CISOs at large enterprises fall in a similar band. Demand for Critical-tier model expertise may be one factor among several influencing AI-security specialist compensation, since the skill set that combines adversarial machine learning with traditional offensive security is reported to be in short supply.

Should we block Astra API access at the enterprise gateway?

A blanket block is often not the most effective approach. The more productive path is scoped access with logging, defined use cases, red-team registration for security-research prompts, and an incident-response playbook that accounts for both defensive uplift and adversarial-uplift scenarios. The CISO checklist above is a reasonable starting point for a defensible policy.

What are the five things you shouldn't tell any large language model, including Astra?

Regardless of vendor: production credentials, unmasked personally identifiable information about customers or employees, unreleased source code covered by a third-party NDA, regulated health or financial records outside a compliant enterprise agreement, and details of an active security incident that hasn't yet been contained. Enterprise agreements can change the risk profile for some of these, but the default is simple and assumes prompt content isn't the right place.