TL;DR

OpenAI has declared its forthcoming Astra model capable enough at offensive security to sit in the highest risk band its Preparedness Framework defines, the first time it has classified any model that way. The company says Astra can locate flaws nobody has documented and turn them into working attacks against hardened targets, with limited human steering, and that release was pushed back while defences were built.

What the evaluations found

The numbers are unusually specific for a pre-launch disclosure. On a private benchmark built from 20 recently disclosed high-severity V8 bugs — assembled because the public version was assumed contaminated — the model produced code execution far more often than GPT-5.6 Sol while burning fewer tokens. During those runs it turned up two flaws nobody had reported and chained them into an exploit; OpenAI says disclosure to the maintainers is under way.

Expert red teams pushed further. Against a hardened browser the model built a complete compromise chain that broke out of the sandbox and ran commands on the host machine from an opened HTML file. On a hardened operating system it strung several bugs together to climb from an ordinary account to root.

The countermeasures are layered rather than novel. Refusal rates on cyber jailbreak tests rose to 91.5%, against 59% for the current flagship. Chain-of-thought monitoring runs in production, and a flagged task pauses for user review in ChatGPT or Codex — but simply stops when it is running through the API, which is where most business automation lives.

Two labs, two answers, one day

Anthropic published its own enterprise safeguards architecture within hours, and the contrast is instructive. Anthropic’s answer moves monitoring data into infrastructure the customer controls; OpenAI’s keeps detection and gating firmly in-house, with early access to the strongest capabilities rationed to alpha testers.

Looking forward

For UK readers the awkward question is procedural rather than technical. A lab has now announced, ahead of release, that its model crosses a threshold it defined itself, judged against benchmarks it built itself. Britain’s AI Security Institute is resourced to evaluate frontier systems; it has no statutory power to withhold one. That gap was theoretical last month.