GPT-6 (Astra) Arrives: Unprecedented Security Risks Unveiled

Critical rating for Astra

OpenAI assigned a new "Critical" level to the pre‑release model codenamed Astra, indicating that in the cybersecurity domain the model can discover unknown vulnerabilities and develop usable zero‑day attacks in hardened systems. The rating does not imply AGI or overall superiority.

ExploitBench evaluation

ExploitBench tests models by providing a publicly known vulnerability and requiring the model to produce working exploit code, not merely a description. Astra achieved full marks, demonstrating the ability to turn a vulnerability into executable attack code. OpenAI noted possible training‑data contamination but considered the result significant.

Internal high‑severity V8 bug test

OpenAI ran an internal test with 20 high‑severity V8 bugs disclosed between June and August 2026. Astra’s success rate was clearly higher than that of GPT‑5.6 Sol, and it required fewer output tokens to achieve the same result. Security engineer Fouad Matin highlighted the higher token efficiency as a new cost metric.

Discovery of unknown zero‑days and attack chaining

In the internal evaluation Astra discovered two previously unknown zero‑day vulnerabilities and linked them into a complete attack chain, showing autonomous path planning, tool selection, permission acquisition, and verification without step‑by‑step human guidance.

OpenAI’s response

OpenAI delayed parts of Astra’s development and release to add additional defenses that meet its internal safety framework, reflecting concern that the model’s capabilities could be dangerous without sufficient safeguards.

Implications for future model competition

Comparisons between Fable 5.1 and Astra illustrate a shift in competition:

Emphasis on long‑running agents that can self‑select tools, self‑correct, and operate continuously.

Adoption of tiered access based on identity, use‑case, industry, and permission level.

Evaluation criteria expanding beyond raw benchmark scores to include permissions, monitoring, token cost, public availability, and built‑in defenses.

Security questions becoming mandatory in model cards, e.g., ability to discover backdoors or construct attack chains in sandboxed environments.

The emerging paradigm treats models as systems that must be managed, restricted, and reliably integrated into real workflows rather than solely judged on answer quality.