OpenAI says it can no longer rule out critical cyber capabilities in its next model

OpenAI published a disclosure on August 7, 2026, stating that internal evaluations of an upcoming model, codenamed Astra, showed cyber capabilities strong enough that it cannot rule out the model has crossed the "Critical" threshold in its Preparedness Framework. This is the first time OpenAI has said this about the cyber category specifically. Every prior model, including GPT-5.6-Sol, was assessed at "High." I want to walk through what that threshold actually means, what OpenAI is doing about it, and where I land on it.

What "Critical" means here

The Preparedness Framework isn't a vibe check — it's a tiered capability scale (Low, Medium, High, Critical) that OpenAI committed to in December 2023, before any model was close to tripping the higher bands. For cybersecurity specifically, a model hits Critical if it can do either of two things without a human in the loop: identify and build functional zero-day exploits across all severity levels against hardened, real-world systems, or take a high-level goal alone and devise and execute a complete novel attack strategy against a hardened target end to end.

That second clause is the one worth sitting with. It's not "the model can write exploit code when you ask it to." It's closer to: give it an objective, and it plans the campaign, adapts to what it finds, and carries it through — the way a capable red team operator would, minus needing the operator.

OpenAI is explicit that this is preliminary and that Astra was not involved in the recent Hugging Face security incident. The framing is "cannot rule out," not "confirmed." That's a meaningfully different claim, and it's worth taking OpenAI at its word on the distinction while the evaluation continues.

What actually changed operationally

The response is concrete, not just rhetorical. OpenAI says it is: running Astra-related work in isolated testing environments with restricted network and tool access; hardening model weight protection and encryption; adding monitoring and detection capable of catching risky behavior sooner; and sandboxing execution. Anything involving Astra that doesn't yet meet this bar is paused internally — the security controls come before the capability gets to keep moving, not after.

The part I find most technically interesting is universal chain-of-thought monitoring across every agentic use of Astra, including training and evaluation runs. Monitors watch the model's reasoning trace, not just its final output, and can trigger a security response to interrupt a high-risk action mid-stream. That's a bet that CoT stays legible enough to police in real time — a bet that gets harder to sustain as models are optimized against exactly that kind of scrutiny, but it's a reasonable stopgap given what's available today.

OpenAI also says it will bring in government agencies and select AI safety organizations to test the model independently, and will hand those partners recommended security controls for running the higher-risk evaluations themselves. That's the right instinct: a lab grading its own capability disclosure has an obvious credibility problem, and third-party replication is the only real check on it.

My take

I work with agentic systems in production, and the operational shift here is the part that should generalize past OpenAI. Once a model can act on a goal rather than execute a prompt, your threat model stops being "what can this model be tricked into outputting" and becomes "what can this model do once it's holding tool access and a multi-step plan." That's true whether you're building red-team tooling, an internal coding agent, or a customer-facing assistant with API access — the containment questions are the same ones OpenAI is now applying to Astra: what's the model's tool and network scope, what's watching its intermediate reasoning, and what happens automatically when it crosses a line.

The useful signal isn't the codename or even the specific threshold crossed — it's that a lab pausing internal work on its own most capable system, ahead of a hard release decision, is a Preparedness Framework doing the job it was built for in 2023. Worth watching whether the eventual final evaluation confirms Critical, and if so, what a defender-first deployment of that capability actually looks like in practice.