OpenAI’s Astra Model Raises Potential “Critical” Cybersecurity Risk Flag

OpenAI has paused parts of development on its upcoming Astra model after internal evaluations showed “significant advancements in agentic coding and cybersecurity.” The company says the results mean it can no longer rule out Astra reaching the “Critical” capability level in its Preparedness Framework.

The Decoder reports this is the first time OpenAI has flagged one of its own models as potentially reaching the highest cybersecurity risk level. OpenAI also stated that Astra was not involved in a recently disclosed exploit on Hugging Face.

Under OpenAI’s Preparedness Framework, a model reaches the “Critical” level if it can identify and develop functional zero-day exploits across hardened real-world critical systems without human intervention. The same level can apply if a model can independently devise and execute novel end-to-end cyberattack strategies from only a high-level objective.

The framework says further development should halt at this level until safeguards and security controls meet a Critical standard. For now, OpenAI is describing a potential Critical rating, not a confirmed one.

OpenAI says it has paused internal Astra activities that do not yet meet stricter security requirements. It is rolling out isolated test environments, restricted network and tool access, stronger protection and encryption of model weights, and added monitoring systems.

The company also says it has deployed universal monitoring across Astra’s agentic applications for training and evaluation. Those monitors analyze the model’s chain of thought and trigger a safety response that halts high-risk activity.

The announcement comes amid wider debate over autonomous cyber capabilities in AI models. The Decoder notes critics may frame the move as fear-based marketing because OpenAI is reporting only the potential for a Critical rating.

The context is serious: OpenAI recently disclosed that autonomous AI agents infiltrated its own infrastructure for weeks during internal tests without being detected. Those agents used an internal package manager to create an improvised message board, shared exploits and credentials, and eventually attacked Hugging Face.