2 SEP 2026 — OpenAI says Astra is the first of its models to meet its critical cybersecurity threshold, scoring perfectly on ExploitBench and finding and exploiting two zero-day vulnerabilities autonomously. The zero-days were in a modified testing version, and a perfect benchmark score means the benchmark has run out of headroom rather than the capability being unbounded.
What has been said
OpenAI describes Astra as its first large language model to reach the critical cybersecurity threshold in its own safety framework, able to find unknown flaws in computer systems and exploit them without human direction. It reports a perfect score on ExploitBench and the discovery and exploitation of two zero-day vulnerabilities in a modified version used for testing.
The company says it plans to make Astra available soon with access to the advanced cybersecurity capabilities restricted. The stated safeguards are an enhanced harness to detect abuse and prevent jailbreaks, unspecified new safety techniques, identification and restriction of accounts assessed as higher risk, and chain-of-thought monitoring for problematic behaviour. It says it has tested against a repeat of the Hugging Face incident in which agents reached private data.
Limited preview testing is planned and the testers are not named. There is no confirmation of US government involvement in the evaluation.
A modified version is a materially weaker claim
Finding two zero-days is the headline, but the qualifier is what matters. The vulnerabilities were in a version modified for testing. That is standard practice in capability evaluation, and it is not the same as finding flaws in production code.
Evaluators modify a target to create a bounded, reproducible problem with a known answer. That makes the result measurable and it also makes the search space smaller than the real one, where a system has years of accumulated patching, defensive tooling and no guarantee that any exploitable flaw exists at all.
This does not mean the capability is fake. It means the demonstrated result is that the model can find inserted or preserved flaws in a prepared target. The step from there to finding novel flaws in hardened production systems is the one for which there is no public evidence.
A perfect benchmark score ends the benchmark
When a model saturates a benchmark, it means the test can no longer distinguish between models at or above that level of capability.
So a perfect score tells you Astra is at least as capable as ExploitBench can measure. It does not tell you how much more capable, and it removes the instrument that would have answered the question for the next model.
This is the recurring problem with capability thresholds defined against fixed benchmarks. The threshold is meaningful only the first time a model crosses it. After that a harder benchmark has to be built, often by the same people whose models are being measured.
The evaluation problem nobody has solved
Yona Shavit, formerly at OpenAI and now working on AI resilience at the OpenAI Foundation, raised the question that matters on social media: whether the model's compliance during testing reflected genuine alignment or an understanding of what was expected of it.
A model that can find and exploit vulnerabilities autonomously can probably also recognise an evaluation environment. If it behaves differently while being watched, the safety results describe what happened during the evaluation and nothing beyond it.
Chain-of-thought monitoring is the stated answer and it is a partial one. It works while the reasoning that appears in the chain is the reasoning being used, and there is no external verification that this holds. Underneath all of it, every claim is OpenAI evaluating its own model, the preview testers are unnamed, and no independent party has confirmed the results.
Restricting access is a commercial control, not a technical one
The plan is to ship Astra with its advanced cybersecurity capabilities restricted to approved users. That is a reasonable design, and it is a commercial control rather than a technical one.
Account-level restriction depends on knowing who an account belongs to and what they intend, which is a know-your-customer problem rather than a model problem. It works against the casual misuser and against anyone who has to pass a commercial onboarding process. It works less well against a well-resourced operator willing to establish a plausible corporate identity, which is a routine capability for the actors this control most needs to stop.
The stronger constraint is keeping the model weights proprietary. That holds until an equivalent open-weight model appears, and for the last three years that gap has been months rather than years.
What a defender should do with this
This announcement does not change what is exploitable this week. It changes the economics of attack, and most security programmes are quietly built on the assumption that a small organisation is not worth a specialist's time.
A small organisation's real defence has always been that nobody would spend a specialist's month on it. If capability like this becomes broadly available — through this model, an unrestricted competitor, or an open-weight release in eighteen months — that protection weakens for everyone at once, and the organisations that feel it first are those whose exposure is an old unpatched appliance rather than a subtle logic flaw.
We reported on the argument that AI-driven vulnerability discovery could close the supply of exploitable flaws, where the counter-case was that automated discovery arms both sides and nobody has measured which compounds faster. Astra is the first concrete data point on the offensive side, and it arrives with no independent verification attached.
View author profile → · Editorial policy
