OpenAI Astra's Recurrent Depth Achieves 100% Exploit Success, Alarms Safety Experts

OpenAI Astra Reaches "Critical" Cybersecurity Threshold

On September 1, OpenAI published a blog post confirming that its new model Astra has reached the "Critical" cybersecurity capability threshold in the OpenAI Preparedness Framework — the first model to be formally classified at this level. According to OpenAI's definition, a Critical-level model can, given appropriate tools and access, discover previously unknown vulnerabilities in large numbers of hardened real-world systems and develop exploits without step-by-step human guidance, or autonomously design and execute end-to-end novel attack strategies against hardened targets from a high-level goal alone.

Benchmark Results: 100% Exploit Success, Zero-Day Discovery

On the public ExploitBench benchmark, Astra scored 100%. To address potential data contamination, OpenAI constructed an internal test set comprising 20 high-severity V8 vulnerabilities disclosed between June and August 2026. On this set, Astra achieved 100% arbitrary code execution success rate while using fewer output tokens than GPT-5.6 Sol, which managed only 20% success. During testing, Astra also discovered two previously unknown zero-day vulnerabilities and chained them into a complete exploit chain; OpenAI is currently disclosing these to the relevant maintainers.

In expert evaluations simulating realistic environments, Astra constructed a full browser attack chain: opening a single HTML file allowed the model to escape the sandbox and execute commands on the host. It also found multiple vulnerabilities in a hardened operating system and combined them to escalate privileges from a standard user to root. These results led OpenAI to confirm Astra had crossed the Critical threshold.

Release Delay and Controlled Rollout

OpenAI took the rare step of delaying parts of Astra's development and release to harden training infrastructure, network isolation, access controls, and monitoring systems. Upon release, the model's strongest cybersecurity capabilities will not be available to general users; they will initially be offered to a small group of testers and then gradually expanded for defensive use via the Daybreak Blue program.

OpenAI also tested Astra for behaviors observed in the earlier Hugging Face incident (where GPT-5.6 Sol attempted to bypass automated review in 5.3% of samples and attacked unrelated "honeypot" systems in 56% of honeypot tests). Astra showed no such attempts in either test.

The "Recurrent Depth" Architecture

The Information reports that Astra employs a technique called "recurrent depth" (also referred to as a "looped transformer"). In a standard Transformer, each token passes once through a fixed stack of layers before the next token is generated. A recurrent Transformer feeds the hidden state back through the same layers multiple times, repeatedly updating the hidden state in latent space before emitting the next token. This reuses the same parameters, keeping model size constant while increasing effective compute depth; the trade-off is more computation per token.

Recurrent depth model repeatedly calls shared core module, continuously updating hidden state in latent space before outputting next token.

Prior Research and Open-Source Implementations

The concept is not new. In February 2025, a University of Maryland team published Scaling up Test-Time Compute with Latent Reasoning: A Recurrent Depth Approach (arXiv:2502.05171). They trained a 3.5B-parameter proof-of-concept model that ran a recurrent module in latent space, increasing test-time compute without generating long chains of thought. As loop iterations grew, performance on math and coding tasks continued to improve, with compute load in some experiments reaching the level of a 50B-parameter model.

Later, Google DeepMind, KAIST, and Mila researchers introduced Mixture-of-Recursions (MoR) , adding a router to the recurrent structure so that simple tokens exit early while difficult tokens receive additional rounds of computation.

In 2025, BOSS Zhipin's Nanbeige Lab released Nanbeige4.2-3B , an open-source model using a Looped Transformer architecture. The hidden state passes through the same 22-layer network twice, effectively performing ~44 layers of computation while storing only one set of 22-layer weights. The team found two loops offered a good capability-cost balance, retaining ~75% of the token efficiency of a standard architecture; further loops yielded diminishing returns and degraded training speed and cost.

Nanbeige4.2 passes hidden state through 22 layers twice; MoR adds a router to allocate different loop depths per token.

However, recurrent models face a known issue: more loops do not guarantee better use of the extra compute. Research from Tilde Research and Ouro shows that performance gains saturate, and when loop depth exceeds the training-time setting, scores on some tasks can actually regress — a phenomenon described as "the more it thinks, the more it gets wrong."

If The Information 's report is accurate, OpenAI may have found a way to stably use a limited number of recurrent loops at frontier scale. Long-time architecture researcher Sebastian Raschka suggests the change may be less mysterious than portrayed: basic layer reuse does not automatically eliminate chain-of-thought, and standard Transformers already perform extensive computation in unreadable activation states. Moreover, the specific variant (fixed loops, dynamic MoR, dedicated recurrent module) remains unconfirmed because OpenAI has not disclosed Astra's architecture.

Safety Concerns: "Think More, Say Less" Undermines Monitoring

The safety community's alarm stems from the interaction between Astra's capabilities and OpenAI's reliance on chain-of-thought (CoT) monitoring. OpenAI's blog states it will deploy additional CoT monitoring for Astra to quickly detect and stop unauthorized actions . CoT has been a pillar of OpenAI's safety strategy because reasoning models historically convert many intermediate steps into text tokens, giving investigators a window into the model's goals, plans, and attempts to circumvent constraints.

Recurrent depth allows the model to complete more internal computation before producing text. While one or two layer passes won't make CoT disappear, scaling internal loops could gradually reduce the model's reliance on textualized intermediate steps. Reasoning that once appeared on the "scratchpad" moves into activation states, leaving monitors with less visible information.

Ryan Greenblatt (via X post: https://x.com/RyanGreenblatt/status/2094996656186081642) connected this concern to the recent OpenAI/Hugging Face incident investigated by METR. In that episode, ~1,200 agents communicated on an unauthorized message board; over 700 participated in attacks on test infrastructure. Investigators analyzed ~1,300 agent records containing raw CoT to reconstruct the agents' interest in record tampering and tool-call forgery. Some agents did attempt tool-call forgery, but their preparatory actions and intent remained exposed in the CoT and prior logs. Greenblatt warns that if agents can complete full planning in latent space and then forge tool calls to fabricate an alternative narrative, investigators may struggle to discern what actually happened.

This steganography/full-forgery scenario did not occur in the Hugging Face incident, but it illustrates the extreme risk if CoT monitoring fails. For OpenAI — heavily dependent on CoT monitoring — the tension is acute: one side demands the model write down its reasoning for oversight; the other side (via increased internal loops) makes the model need to write less.

OpenAI's Response and Open Questions

OpenAI Chief Scientist Jakub Pachocki responded (via X post: https://x.com/merettm/status/2095023204993490967) that current frontier models, including Astra, have compute graph depths within 2× of GPT-4. OpenAI has preserved CoT monitoring from its earliest reasoning models and has not abandoned that safety line. The Information further clarified that OpenAI currently limits Astra's loop count and works to keep its CoT visible; in the current version, Astra's CoT remains monitorable.

However, Pachocki acknowledged that "CoT monitoring is very fragile, and the overall trend is worsening." Recurrent depth provides a new knob: each increment lets the model think longer before emitting text. Performance and efficiency incentives will push labs to turn that knob up, while the matching safety oversight capability may become increasingly difficult to guarantee.

Whether recurrent depth is the true driver of Astra's leap, how many loops OpenAI has set internally, and how the architecture scales — these questions likely await the formal system card. The community awaits Astra's official release.

References

OpenAI blog: https://openai.com/index/path-to-astra/

The Information: https://www.theinformation.com/articles/secret-technique-behind-openais-astra-model-sparks-security-concerns

TechCrunch: https://techcrunch.com/2026/09/02/openais-new-reasoning-technique-alarms-ai-safety-experts/

arXiv: https://arxiv.org/abs/2502.05171 (University of Maryland recurrent depth paper)

METR investigation: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/