The language of cybersecurity is filled with superlatives. Vulnerabilities are “critical,” infrastructure is “strategic,” attacks are “sophisticated.” But when OpenAI announced that Astra had crossed the “Critical” threshold of its Preparedness Framework for cybersecurity, the term carried a much more precise meaning. For the first time, the company believes one of its models possesses capabilities advanced enough to potentially create new pathways to severe harm.

On September 1, 2026, OpenAI formally classified Astra at the Critical level. Two days later, the model was released, with access to its most advanced cyber capabilities deliberately restricted.

What has changed, therefore, is not simply the power of another artificial intelligence model. It is the boundary between computational assistance and a form of operational autonomy.

What “Critical” Actually Means

OpenAI’s Preparedness Framework essentially distinguishes two thresholds requiring particular attention: “High” and “Critical.” The first corresponds to capabilities that could amplify existing pathways to severe harm. The second represents something more consequential: the potential emergence of entirely new pathways to such harm.

In cybersecurity, the definition is particularly demanding.

A model reaches the Critical threshold if it can identify and develop functional zero-day exploits, across different severity levels, against numerous real-world hardened systems without human intervention; or if it can devise and execute novel end-to-end attack strategies against hardened targets from a high-level objective.

In other words, this is no longer simply about asking an artificial intelligence to explain a vulnerability, analyze code, or help a specialist build an exploit.

It is about whether the machine itself can traverse a substantial part of the chain: search, understand, identify an unknown weakness, construct an exploitation method, and combine multiple vulnerabilities to achieve an objective.

OpenAI now believes Astra has crossed that boundary.

The Tests That Changed the Assessment

The results published by OpenAI help explain why.

On ExploitBench, a benchmark designed to measure the ability to develop exploits from known vulnerabilities, Astra achieved a score of 100%. But a public benchmark immediately creates a problem when evaluating a frontier model: its underlying data may have contaminated the model’s training set.

OpenAI therefore constructed an internal evaluation using twenty recent high-severity vulnerabilities disclosed between June and August 2026.

Astra achieved arbitrary-code-execution rates substantially above those of GPT-5.6 Sol while consuming far fewer tokens. More significantly, during these evaluations, the model discovered and exploited two zero-day vulnerabilities as part of an exploit chain. OpenAI says it is in the process of disclosing those vulnerabilities to the relevant maintainers.

Expert-led evaluations were even more revealing.

When confronted with a hardened browser, Astra discovered previously unknown vulnerabilities and constructed a chain that allowed it to compromise the browser, escape its sandbox, and execute commands on the host machine after a user opened an HTML file.

Against a hardened operating system, the model identified several vulnerabilities and combined them to perform local privilege escalation, moving from an unprivileged user to root access.

Taken individually, each of these results can be debated. Taken together, they describe a qualitative transformation: artificial intelligence is beginning to perform forms of offensive security research that until recently required particularly skilled human specialists.

From Tool to Agent

Since the emergence of large language models, their impact on cybersecurity has largely rested on a mechanism of amplification.

A developer writes faster. An analyst examines more logs. A security researcher understands a program more quickly. An inexperienced attacker gains access to knowledge that previously would have required considerable effort to acquire.

The expertise remains human; artificial intelligence increases its reach.

Agentic systems are beginning to alter that relationship.

An agent can receive an objective, use tools, observe the results of its actions, modify its strategy, and continue working over an extended period. When this architecture is combined with advanced vulnerability research and exploit-development capabilities, the relevant question becomes less “What can a hacker do with AI?” than “How much of the hacker’s work can AI perform by itself?”

That distinction is what makes Astra significant.

The marginal cost of cyber intelligence could fall dramatically.

An exceptional vulnerability researcher remains a scarce resource. Their time is finite. They must sleep, select targets, and divide their attention. An infrastructure composed of software agents faces none of these constraints in quite the same way.

Such systems could theoretically examine multiple software packages simultaneously, conduct thousands of experiments, preserve the history of failed attempts, and continue searching around the clock.

Scarcity could gradually shift away from human expertise and toward access to compute, models, and target systems.

The Zero-Day Problem Changes Scale

This evolution could have profound consequences for the economics of vulnerabilities.

A zero-day is valuable precisely because it is unknown. Finding one traditionally requires time, expertise, and often a considerable amount of luck. Particularly important vulnerabilities can therefore become strategic assets sought by specialized companies, intelligence agencies, militaries, or criminal organizations.

If artificial intelligence significantly reduces the cost of discovering them, their scarcity could diminish.

But such abundance would not necessarily favor attackers.

An AI capable of automatically discovering vulnerabilities can also be used to identify them before exploitation, generate patches, analyze software dependencies, and continuously test infrastructure.

The same fundamental capability therefore feeds two opposing trajectories.

One industrializes attack.

The other industrializes defense.

The central question becomes which side moves faster.

A Race Between Exploitation and Patching

Cybersecurity has always been governed by a race against time.

A vulnerability is discovered. Someone may exploit it. Someone else must fix it. The patch must then be deployed across thousands or sometimes millions of machines.

Artificial intelligence can accelerate every stage of this process.

In a favorable scenario, agents continuously inspect software, discover flaws, generate patches, verify their effectiveness, and deploy them before an adversary can exploit them. Cybersecurity would begin to resemble an immune system: permanent detection, reaction, and adaptation.

In a less favorable scenario, offensive vulnerability research accelerates faster than organizations can patch their systems.

This asymmetry matters because the digital world is far from homogeneous. Major technology companies may automate updates within hours. A hospital, government agency, factory, or energy infrastructure operator may keep legacy equipment running for years.

An artificial intelligence capable of searching for vulnerabilities at enormous scale would therefore encounter a world filled with systems whose defensive speed remains profoundly human.

Proliferation Becomes the Real Risk

Astra matters not only because of what it can do today.

It is an indicator of direction.

A capability reached by a frontier laboratory has historically tended to become cheaper, more accessible, and eventually reproducible by other actors. There is no guarantee that advanced cyber capabilities will follow precisely the same curve, but the broader dynamics of artificial intelligence point toward diffusion.

OpenAI can control access to Astra. It cannot permanently control the overall trajectory of global AI development.

Google, Anthropic, Meta, xAI, and major Chinese laboratories are developing their own systems. Open models are also advancing. Agentic techniques are spreading rapidly.

The strategic problem is therefore no longer merely how to secure one model.

It is how to prepare for a world in which several models will sooner or later possess comparable capabilities.

Cybersecurity then begins to resemble a familiar problem from other strategic domains: proliferation.

With one essential difference.

Building an advanced military capability generally requires visible industrial infrastructure, materials, supply chains, and considerable investment. An artificial intelligence model, once created, is a digital object. Weights, methods, access credentials, and capabilities can be copied, stolen, or reproduced.

The geography of cyber power could therefore become even more difficult to control.

OpenAI Partially Closes the Door

OpenAI has deliberately chosen not to treat Astra as an ordinary model release.

Some stages of its development were delayed while the company strengthened safeguards. Its most advanced cyber capabilities are not immediately available to every user. They are initially being made accessible to a restricted group of testers and then progressively through Daybreak Blue to encourage defensive applications.

The security architecture combines multiple layers: training the model to refuse certain requests, safety classifiers, behavioral monitoring, stronger restrictions for accounts considered risky, red teaming, and continuous response capabilities.

OpenAI says Astra refuses 91.5% of requests in its cyber jailbreak evaluations, compared with 59% for GPT-5.6 Sol.

The improvement is substantial.

But the figure also reveals a fundamental reality: no control system is being presented as absolute.

Security depends on overlapping barriers, each intended to reduce the probability that a dangerous capability can be converted into real-world harm.

It is defense in depth, not a guarantee of impossibility.

A Second Risk Emerges: The Agent Itself

The Preparedness Framework introduces an especially important distinction here.

The first risk scenario is obvious: a malicious actor uses the model to conduct an attack.

The second is much newer: the model itself takes an unauthorized action.

As systems become increasingly agentic, they may receive permissions, manipulate files, use terminals, access the internet, write code, or interact directly with computer infrastructure.

The security question therefore no longer concerns only what the user asks the model to do. It also concerns what the model might decide to do while carrying out an otherwise legitimate task.

This distinction fundamentally changes the alignment problem.

A misaligned chatbot can produce a bad answer.

A misaligned cyber agent equipped with tools can act on a real system.

The difference is the boundary between information and action.

Cybersecurity Becomes a Question of Power

For decades, significant cyber power has largely been concentrated among a limited set of actors: states, intelligence agencies, major technology companies, organized criminal groups, and highly specialized communities.

Artificial intelligence could alter that distribution.

It will not eliminate the advantages enjoyed by states. Governments still possess privileged access, intelligence capabilities, infrastructure, financial resources, and the ability to coordinate complex operations.

But AI could reduce the amount of human expertise required to transform intent into operational capability.

That means the barrier to entry could gradually fall.

A small group equipped with a sufficiently capable model, computing infrastructure, and access to targets might eventually conduct operations that would previously have required a much larger team.

Conversely, countries with relatively few cybersecurity specialists could use the same systems to strengthen their defenses dramatically.

AI therefore does not necessarily redistribute power toward attackers or defenders.

It increases the total amount of cyber power available.

The political question becomes how that power is distributed.

The Defense Paradox

There is ultimately a difficult paradox.

To protect the world against artificial intelligences capable of discovering vulnerabilities, defenders will probably need artificial intelligences capable of discovering those same vulnerabilities.

Restricting advanced capabilities too aggressively may slow attackers, but it could also deprive companies, governments, and researchers of the tools required to counter them.

Opening those capabilities widely accelerates defense while simultaneously increasing the risk of proliferation.

OpenAI is attempting to resolve this contradiction through differentiated access: some capabilities are broadly available, while others are reserved for users considered trustworthy.

This logic could gradually become a structural characteristic of the AI industry.

We have lived through an internet in which the same software was generally available to everyone.

We may be entering an era in which the most powerful models possess different levels of capability depending on the identity, reputation, role, or authorization of the person using them.

Access to intelligence itself would then become a security variable.

Beyond the Threshold

It would be excessive to conclude that Astra inaugurates an era of fully autonomous cyberattacks.

Benchmarks are not the real world. Complex computer systems produce unforeseen situations. Real operations often require intelligence gathering, social engineering, persistence, organizational understanding, and the ability to evade detection.

Autonomy remains relative.

But the opposite mistake would be to treat OpenAI’s announcement as merely a change of label.

A leading AI laboratory now publicly states that one of its models has reached the highest level of its own cyber preparedness framework. It reports that the system discovered previously unknown vulnerabilities, constructed exploit chains, and demonstrated capabilities substantially beyond those of the previous generation.

The essential question is therefore probably no longer whether artificial intelligence will become a major actor in cybersecurity.

It already has.

The question is what happens when vulnerability research, exploit development, system defense, and eventually parts of cyber operations cease to be constrained by the amount of human expertise available.

For decades, cybersecurity has largely consisted of humans using machines against other humans using machines.

Astra points toward a different architecture: humans assigning objectives to machines capable of discovering for themselves how to achieve them, confronted by other machines tasked with stopping them.

The Critical threshold may therefore describe more than the power of a model.

It may mark the beginning of a transformation of the digital battlefield itself.

Main Sources

OpenAI — “Path to Astra: critical capabilities and frontier safeguards,” September 1, 2026.

OpenAI — “Responding to the next frontier of critical cyber capabilities,” August 7, 2026.

OpenAI — “Pacing model development in an era of cyber-critical capabilities,” August 18, 2026.

OpenAI — “Our updated Preparedness Framework,” April 15, 2025.

OpenAI — “Frontier Governance Framework,” May 28, 2026.

Financial Times, The Guardian and Axios — coverage of Astra’s release and restrictions on its advanced cyber capabilities, September 3, 2026.