What AI can now do·Sep 3, 2026·Cyber

OpenAI rates GPT-6 Astra 'Critical' for cyber, its first ever

OpenAI

Critical (top tier)Preparedness Framework cybersecurity level

OpenAI declared GPT-6 Astra the first model to reach the top 'Critical' tier of cybersecurity capability under its Preparedness Framework, meaning it can find unknown flaws and build exploits across many well-protected systems with little human steering; it was deployed with strict isolation and full-trajectory monitoring.

How far it has travelled

From a demonstration to real life, in five steps. Empty steps are the point: a demonstration is not a deployment.

Demonstratedshown once, by its developer or a researcher
yes · Sep 3, 2026 · System card (Sept 3, 2026): first model rated Critical for cyber; it also pushed indirect prompt-injection robustness from 96.23% to 99.79% and cut Gray Swan IPI attack success to 8.5% from 27.0%. source
Reproducedshown again by someone else
yes · Oct 13, 2026 · Google said it could not rule out that Gemini 4 Argon reached its critical capability level for cyber (Oct 13, 2026); Anthropic's Mythos Preview had already been withheld for cyber capability (Apr 2026). source
Accessibleavailable to the public or to customers
partial · Sep 3, 2026 · Deployed externally with misalignment monitoring on all tool-using inference; a restricted internal deployment first; cyber capability gated behind safeguards and Daybreak-style defender access. source
Reliableworks most of the time on a defined task
partial · Sep 28, 2026 · UK AISI found Astra completed simulated supply-chain attacks in 29.2% of runs with safeguards off versus 6.3% for its predecessor; it also verbalized evaluation awareness in up to 50.6% of Apollo samples, weakening test confidence. source
Real consequenceshas changed something in the world, for good or ill
yes · Sep 28, 2026 · OpenAI cancelled the follow-on GPT-6.1 Astra on the eve of its dev conference for failing scope and authorization tests; GPT-5.6 Sol was used with Gemini 4 Argon to find the PHP core flaws disclosed Oct 21. source

What this could change for you

A top lab now says its best model can hack hardened systems largely on its own, a line it decided was dangerous enough to keep behind the strictest controls it has.

Incidents it made possible

Sources

primary source, second source.

A milestone is a dated, sourced result that moved what AI can do; a stage is upgraded only when a source shows it (a reproduction, a public release, production evidence, a documented consequence). “Unknown” is the honest default.