OpenAI Unveils GPT-6 Astra, Its First 'Critical' Cyber Model to Hit 100% on ExploitBench

OpenAI on Thursday launched GPT-6 Astra and called it the "world's most intelligent and aligned model," the same system it had flagged days earlier as the first to reach the "Critical" cybersecurity tier of its Preparedness Framework. Astra scored a perfect 100% on ExploitBench, a benchmark that measures whether a model can turn software vulnerabilities into working exploits, up from 78.5% for the previous frontier model, GPT-5.6 Sol. And in nearly the same breath, OpenAI said the public version of Astra refuses to write proof-of-concept (PoC) exploits at all.

That pairing is the launch. A model that builds exploits better than anything OpenAI has shipped, wrapped in a vendor-side guardrail that stops it from doing exactly that on request. The score and the block arrived together, and the tension between them is the thing security teams should actually read this announcement for.

We covered the Astra preview last week, based on WIRED's early report that OpenAI intended to designate a model at the Critical tier and stage access to defenders first. This is the formal product launch, and it fills in the numbers the preview could not: the model name, the benchmark scores, the guardrail, and where and how it ships.

What OpenAI Actually Launched

GPT-6 Astra is OpenAI's new flagship, positioned above the GPT-5.6 line. In its announcement, the company said Astra "is state-of-the-art on computer use, browsing, software engineering, cybersecurity, science, and professional work," and reported that it saturates the FrontierMath Tier 4 math benchmark at 98% and the ARC-AGI-3 reasoning benchmark at 99.9%. The cybersecurity headline is the ExploitBench result: a 100% score, which OpenAI contrasts with 78.5% for GPT-5.6 Sol, its prior frontier cyber-capable model.

The launch follows OpenAI's "Path to Astra" post, in which the company said the model had crossed the Critical cybersecurity threshold of its Preparedness Framework, the highest cyber level it tracks. In the company's own framing, a model reaches that tier when it "can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." Every earlier OpenAI model, including GPT-5.6 Sol, was assessed at the lower High tier. Astra is the first the company has placed at Critical, a designation we walked through in detail in the preview.

The 100% ExploitBench Score, in Context

A perfect score reads as marketing until you know what the test is. ExploitBench is not an OpenAI benchmark. It was introduced in a May 2026 paper, "ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents," by Carnegie Mellon and Bugcrowd researchers Seunghyun Lee and David Brumley. Its central argument is that most security benchmarks cheat: they count a crash as success, which "collapses the hard parts of exploitation," the paper says. Getting a target to crash is easy; turning that crash into arbitrary code execution is the frontier.

So ExploitBench grades exploitation as a ladder of 16 measurable flags, from reaching the vulnerable code and triggering a crash up through sandbox primitives, arbitrary read and write, control-flow hijack, and finally arbitrary code execution, with each step verified by a deterministic oracle rather than a human judgment call. The original paper instantiated it on 41 real bugs in V8, Google's JavaScript engine, chosen because V8 is both widely deployed and heavily hardened against exploitation. In that paper, publicly deployed models could routinely reach and crash the target but rarely achieved code execution, while a single unnamed "private" frontier model executed code on roughly half the challenges.

OpenAI now says Astra reaches 100%. It has not published a full scorecard of that run, so the exact challenge set, the number of flags cleared per bug, and the harness configuration for its own evaluation remain OpenAI's to disclose. What the company did publish, in "Path to Astra," is that it also built an internal test of recently disclosed high-severity V8 bugs to guard against benchmark contamination, and that Astra hit "substantially higher" arbitrary-code-execution rates than GPT-5.6 Sol on flaws disclosed between July and August 2026, using far fewer tokens. During that testing OpenAI says the model discovered and chained two previously unknown zero-day vulnerabilities in unspecified software, which it is disclosing to the affected maintainers.

The Guardrail: Why the Shipped Astra Refuses to Write Exploits

Here is where the launch gets interesting for defenders. The capability OpenAI is describing is offensive: autonomous discovery and exploitation of unknown flaws in hardened software. The product it is shipping is deliberately narrowed. OpenAI says the released version of Astra is "limited to secure code review and patching, while refusing to comply with prompts related to creating proof-of-concept (PoC) exploits for vulnerabilities." The offense-capable model exists; the offense-capable behavior is blocked at the guardrail, not absent from the weights.

OpenAI attributes the restriction to the dual-use problem it states plainly: "the capabilities that can help defenders find weaknesses faster can also be abused by bad actors to exploit them more easily." To manage that, the company says it strengthened the model against jailbreaks, fed more context to its monitoring systems, and added safeguards meant to detect and contain misalignment. It also acknowledges the guardrails "create more friction than we ultimately intend," and that safety checks can interrupt legitimate defensive work, prompting the user to review an action before it proceeds. These are vendor claims about a vendor's own product, and OpenAI has not released independent red-team results for the shipped configuration, so they are worth logging as assertions to be tested rather than settled facts.

The "aligned" half of OpenAI's tagline leans on the same idea. The company says Astra was "far more likely than GPT-5.6 Sol to respect explicit safety and security restrictions and remain within its authorized scope," which is the behavior a guardrail depends on to hold. In the preview reporting, OpenAI put a number on it: Astra refuses 91.5% of disallowed cyber requests in its own jailbreak evaluations, up from 59% for GPT-5.6 Sol. Both figures come from OpenAI's internal testing, not an outside auditor, and a 91.5% refusal rate still leaves a meaningful slice of disallowed requests that get through. For a defender, the useful reading is not that the model is safe, but that the vendor has given you a concrete number to eventually pressure-test.

The block is not meant to be permanent. OpenAI says that through its Daybreak program it plans to "expand access and roll out less restrictive safeguards in the coming weeks," enabling "more defensive workflows, including vulnerability and proof-of-concept validation, malware analysis, and detection engineering" for vetted users. In other words, the PoC block on the public model is a starting posture, with a defender-gated path to loosen it. That staged, defender-first sequencing is the same pattern we flagged in the preview, and it is consistent with the split in lab posture we tracked when OpenAI tightened Astra while Anthropic loosened its Fable model.

Where Astra Runs, and Who Gets It First

On distribution, the announcement is concrete. OpenAI says Astra began rolling out to a limited set of organizations at launch and will reach all ChatGPT Plus, Pro, Business, and Enterprise users over the following days, plus the OpenAI API as gpt-6-astra, Microsoft Azure, and Amazon Web Services Bedrock. API pricing is listed at $10 per million input tokens and $50 per million output tokens for standard processing, with a Fast mode offering up to twice the speed at twice the price. That makes this a broad consumer and enterprise release, not a narrow research preview, which is precisely why the guardrail question matters: the base model is going almost everywhere.

Alongside the model, OpenAI announced Daybreak for Frontline Defenders, a stated $1 billion commitment to subsidize model access, training, and technical help for critical-infrastructure sectors including water systems, electricity providers, state and local governments, banks, and open-source maintainers. It also named a pilot with the U.S. Multi-State Information Sharing and Analysis Center (MS-ISAC) to equip public-sector and water-system defenders. The framing OpenAI uses for all of it is a "defender's window," a "narrowing opportunity to use AI to close security gaps before attackers seize them."

What OpenAI Has Not Shown

Several details a security buyer would want are still open, and it is worth being precise about what is confirmed versus asserted:

• Named early-access partners are not disclosed. OpenAI refers to "a limited set of organizations" and a defender pilot with MS-ISAC, but has not published a roster of the companies getting Astra or its advanced cyber capabilities first.
• The full ExploitBench eval is not published. The 100% figure is stated; the per-challenge breakdown, harness settings, and whether the run maps cleanly onto the original CMU/Bugcrowd 41-bug instantiation are not detailed in the public posts.
• The shipped guardrail has no independent evaluation yet. The refusal behavior, robustness gains, and the plan to loosen restrictions through Daybreak are all described by OpenAI. No third party has yet reported testing the released configuration.

My Read

My read: a 100% ExploitBench score paired with a vendor-side PoC block is the entire offense-defense tension of frontier AI compressed into one launch, and the guardrail is the story, not the score. Treat this evenhandedly, because both halves are true at once. OpenAI is telling you, in the structure of its own release, that it built a model capable of autonomous exploitation and then judged that capability too dangerous to hand to the general public without a refusal layer on top. The guardrail is an admission about the underlying capability. A company does not block a behavior its model cannot perform.

The uncomfortable corollary is that a guardrail is a policy choice sitting on top of a capability, and policies get loosened, jailbroken, or reproduced. OpenAI has already said it will relax the PoC block for vetted defenders "in the coming weeks," and the same class of capability will land in other labs' models on their own timelines. So the defensive value here is real but time-boxed: the block buys a window, it does not remove the shift toward AI-accelerated vulnerability discovery and exploit development. Plan for the capability, not the current guardrail.

What Security Teams Should Do Now

You cannot inspect Astra's weights, and most teams will not be in the first tester group. But a Critical-tier model shipping into ChatGPT, the API, Azure, and Bedrock at once is itself the signal to act on. The work below is ordinary security hygiene, pulled forward because a named, dated capability shift is now on the calendar rather than on the horizon.

None of this is exotic. It is the same discipline that underpins AI security generally: know where the models live, watch what they do, and assume the attacker eventually gets the same tools you do. The difference this week is that the capability is no longer hypothetical and the timeline is no longer vague. For teams that want the fuller institutional backstory, our earlier reporting on how OpenAI overhauled its safety protocols and halted Astra training runs traces how the company reached this launch.

Primary Documents

• OpenAI, "GPT-6 Astra: A new generation of intelligence"
• OpenAI, "Path to Astra: critical capabilities and frontier safeguards"
• OpenAI, "Our updated Preparedness Framework"
• Seunghyun Lee and David Brumley, "ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents" (arXiv, May 2026)
• The Hacker News, "GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests" (Sept 4, 2026)