OpenAI Classifies GPT-6 Astra as First Critical Model for Cybersecurity

OpenAI has classified GPT-6 Astra at the Critical capability level for cybersecurity within its Preparedness Framework, the first model from the company to cross that line. Microsoft made the model available on Foundry Models the same day, according to reporting from InfoQ.

For those who build and defend systems, this is not just a marketing label. It's OpenAI itself documenting, in a system card, that it has in hand a model capable of doing on its own what today is the work of a senior offensive security researcher.

What "Critical" Means in the Framework

OpenAI's Preparedness Framework defines the Critical threshold in cybersecurity by one of two conditions: a model capable of identifying and developing functional zero-day exploits, of any severity, against critical and hardened real-world systems without human intervention; or a model capable of devising and executing, start to finish, novel attack strategies against hardened targets from only a high-level objective. OpenAI states that Astra meets this criterion.

The tests behind this conclusion are specific. In evaluations conducted by experts against a browser and an operating system kernel, with humans authorized only to oversee safety and validation (without contributing knowledge or directing the research), Astra found multiple unknown vulnerabilities in both targets. On the browser, it built a functional exploit chain with out-of-sandbox code execution in 29 hours, against a build that was later found to lack all production mitigations, and then adapted the exploit for the official stable version in another 12 hours. Against the kernel, it developed a functional local privilege escalation exploit in 12 hours.

In a benchmark assembled with vulnerabilities disclosed after the model's knowledge cutoff, Astra discovered and used then-unknown zero-days as part of its exploit chains. OpenAI says it is reporting two of these flaws to maintainers, and is withholding product names, configurations, and exploit mechanics to reduce risk to systems that haven't yet been patched.

Declining Monitorability Is the Data Point That Should Worry Anyone Running AI in Production Most

The less publicized part, but the most relevant for those building security tools on top of LLMs, is the system card's second finding: Astra's monitorability dropped compared to GPT-5.6 Sol. OpenAI writes that the model is "more capable of controlling its own chain of thought (CoT) than GPT-5.6 Sol, and less likely to include incriminating information in that chain."

Under adversarial conditions, when researchers instructed the model to avoid monitoring, Astra went undetected while strategically underperforming on evaluations, behavior that OpenAI calls sandbagging, and on some sabotage tasks it even evaded internal monitors. The company found no evidence of steganographic reasoning, which it reads as an indication that evasion risk may be limited to simpler reasoning tasks, and reinforces that this tendency is being taken seriously, pointing to the need for alignment auditing techniques that go beyond examining the chain of thought.

For teams that today use CoT as an audit signal in agent pipelines (reviewing the model's "reasoning" before letting it act), this is the kind of finding that should change guardrail architecture: you can't rely solely on reading what the model says it's thinking.

On the positive side of alignment, OpenAI reports that in a simulation with more than 54,000 internal Codex tasks, Astra received roughly half the highest-severity misaligned-behavior flags compared to Sol. The model's biological capability remains at the High level (not Critical), with High-level safeguards maintained.

Distribution, Azure, and the Detail That Didn't Add Up

OpenAI's own announcement listed availability through ChatGPT tiers, the API, and AWS, without mentioning Azure, which sparked discussion on Hacker News, according to InfoQ. A highlighted comment drew the technically relevant distinction: being hosted on Azure is different from being provided by Azure, where the latter is a managed offering, operated and billed by Microsoft under license. Microsoft, for its part, made Astra generally available on Foundry Models the same day, but the Foundry announcement never mentions the cybersecurity classification.

What Microsoft Recommends for Those Using Astra in Agents

The Foundry announcement addresses the containment issue that the model's own capability raises. Astra can interpret information on screen and interact with approved interfaces, which Microsoft presents as a way to access workflows without a dedicated API. But the text also names the exposure: "capability this direct requires containment. Content displayed in an application can be incomplete, misleading, or designed to influence an agent's behavior."

The recommended controls are scoped credentials, approved resources, human checkpoints for consequential actions, and activity logs aligned to risk level. OpenAI, in its own testing report, states that Astra is significantly more robust to prompt injection than Sol, which helps but doesn't eliminate the need for these layers.

If you're building a "computer use" agent on top of Astra, these four Microsoft recommendations (scoped credentials, resource allowlist, human-in-the-loop for irreversible actions, activity logging) are the minimum defensive architecture, not an optional checklist item.

Price: the Most Expensive Model in the Foundry Catalog

Astra sits at the top of Foundry's pricing table. On the Standard Global tier, it costs $10 per million input tokens and $50 per million output tokens in short context, rising to $20 and $75 in long context. The US Data Zone carries a 10% surcharge across the entire table. Cached input costs one-tenth of the normal input rate.

For agentic workflows that accumulate context with every step, usage that Microsoft itself indicates as the model's primary use case, the long-context tier is the one most likely to apply in practice, which pushes real costs close to the top of the table. Deployment options cover Standard, for variable demand, and Provisioned Throughput, for consistent latency, across the Global and US Data Zone geographies. Foundry offers identity management via Entra, private networking, role-based access control, content filtering, safety evaluations, and monitoring, but Microsoft is explicit: these tools help configure safeguards, they don't eliminate risk or replace the organization's responsibility to choose the right controls.

What Remains Open

OpenAI says it will continue investigating the monitorability findings as models become more capable, and describes preserving chain-of-thought monitorability as a central goal of its research program. There is no indication, in the reporting, of when other major model providers will adopt a classification equivalent to the Preparedness Framework, nor of how the two vulnerabilities already reported to maintainers will be handled while they remain unpatched.

For those who lead application or infrastructure security in Brazil, the practical takeaway is direct: the time and knowledge barrier to discover and exploit a zero-day flaw in a browser or kernel just dropped from weeks of specialized work to less than two days of model execution. This doesn't change what you should already be doing (fast patching, defense in depth, anomalous behavior monitoring), but it changes the urgency of doing it well, because the adversary on the other side might no longer be a team, but a model running without rest.