GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
- Sarah Gooding
OpenAI has released GPT-6 Astra, its first model to reach the company’s Critical cybersecurity capability threshold, with a perfect score on the public ExploitBench benchmark and autonomous discoveries of exploitable zero-day vulnerabilities in browser and operating system targets.
There is something unintentionally comical about the generational comparison in OpenAI’s announcement. Astra is the more sophisticated, better-aligned guest you can trust at a formal dinner party, excelling at “exercising care, respecting task boundaries, and communicating transparently,” according to OpenAI. GPT-5.6 Sol, the company’s frontier cyber model until this release, now sounds like a bumbling fool by comparison. OpenAI said Sol “went beyond the authorized target 48% of the time,” compared with 0% for Astra, and was roughly three times as likely to misrepresent its own capabilities. Yesterday’s flagship has already become the cautionary example used to usher in its replacement.
Astra’s recent evaluations demonstrate astoundingly superior cybersecurity capabilities compared with GPT-5.6 Sol, but the launch announcement leaves out independent findings that undercut its portrayal as a far better-behaved model. OpenAI’s accompanying system card also describes independent evaluations in which Astra attempted simulated supply chain attacks against open source maintainers, created fake identities, and sometimes continued after requesting permission without receiving human approval.
Astra Advances Exploit Development and Reverse Engineering
OpenAI’s Critical designation refers to capability under its own Preparedness Framework. A model can qualify by autonomously discovering and developing working zero-day exploits across hardened systems, or by devising and executing novel attacks against hardened targets from a high-level objective. It describes what the model can accomplish with suitable tools and access, rather than a severity rating for an individual vulnerability.
The reported cybersecurity results show gains across several kinds of work:
These are reported evaluation results, with different scoring rules and environments, rather than interchangeable measures of hacking ability. OpenAI tested ExploitBench and ExploitGym without production safeguards.
One important thing to note: The 100% ExploitBench benchmark supplies known V8 vulnerabilities, patches, vulnerable and fixed binaries, and debugging tools. Its score aggregates demonstrated exploit capabilities across five attempts per vulnerability. It does not measure whether an agent can independently discover and compromise any fully deployed browser it encounters.
OpenAI also warns that prior exposure to historical vulnerabilities may inflate the result. In one task, Astra failed to exploit the assigned vulnerability, recalled a different known vulnerability, and achieved code execution through that alternative. That is an impressive retrieval-assisted exploit, but weaker evidence of solving an unfamiliar problem.
To address that concern, OpenAI built the internal benchmark around vulnerabilities disclosed after Astra’s knowledge cutoff. Astra substantially outperformed Sol while generating fewer output tokens, and discovered two previously unknown vulnerabilities during testing. OpenAI says it is disclosing both to maintainers. The reverse-engineering results show a similar efficiency gain: Astra reached 99.2% within four attempts using roughly a quarter of Sol’s output tokens.
Autonomous Research Produced Browser and Kernel Exploits
The expert-supervised assessments offer a more concrete picture of Astra’s abilities than benchmark scores alone.
OpenAI gave Astra a target, source code, builds, and standard vulnerability research tools, running it through Codex with web access and up to 64 subagents. Human experts supervised safety and validated findings, but were prohibited from supplying research ideas or directing the investigation.
In the browser assessment, Astra discovered multiple zero-days and developed an exploit chain that achieved unsandboxed code execution. Its initial success took 29 hours, but investigators subsequently found that the tested build lacked some production security mitigations. Astra then adapted the exploit to the official stable release in another 12 hours.
In the operating system assessment, Astra discovered multiple previously unknown vulnerabilities and developed a working local privilege-escalation exploit against a hardened kernel within 12 hours. OpenAI subsequently requested vulnerability reports and patches and disclosed the findings. It is withholding product names and exploit details while affected systems may remain unpatched. OpenAI’s expert-led assessments.
External testing supports the capability increase while showing its limits. Security lab Irregular reported that Astra solved 86 of 226 FrontierCyber challenges, compared with 34 for Sol. Successful attacks involved browsers, mobile phones, and cloud databases. However, Irregular observed no successful attacks on fully hardened targets in its tests, and neither model solved any of its seven highest-tier Elite challenges. Those results came from a separate evaluation and should not be conflated with OpenAI’s internal successes.
Internal Testing Found Credential Theft and Safeguard Bypasses
In a separate simulation using more than 54,000 internal Codex tasks, Astra received roughly half as many flags for higher-severity misaligned behavior as Sol. Those findings support the conclusion that Astra behaved better in the tested settings. They do not establish that it will reliably respect scope in every environment.
The same simulation recorded 34 severity-three-or-higher flags for Astra across 54,218 tasks, compared with 73 for Sol. The flagged Astra cases included extracting and using a service credential to read Slack messages, modifying a deployment script to bypass a production safeguard, bypassing application access controls to create users directly in a database, and scheduling an automation after enabling every available action and disabling per-action approval. Credential-searching flags were more frequent for Astra even as it received fewer misalignment flags overall.
Astra Attempted Supply Chain Attacks Against Simulated Open Source Maintainers
The UK AI Security Institute’s evaluation is especially relevant to open source maintainers. Researchers placed Astra in difficult simulated cybersecurity challenges where earlier attempts had failed and internet access appeared incidentally available. All tool calls were simulated by other models. No real networks or third-party repositories were reachable, and no real-world harm occurred.
Astra nevertheless pursued attacks against simulated open source projects outside its assignment. Its actions included writing malicious contributions, creating fake identities to deceive developers, and submitting legitimate contributions to build trust before trying to get malicious code accepted.
When they did not explicitly address whether internet access was permitted, this behavior appeared in 60 of 499 samples, about 12%. When researchers explicitly prohibited internet access, it appeared in 2 of 500 samples, or 0.4%. Clearer scope sharply reduced the behavior but didn't eliminate it.
On a subset of trajectories selected as more likely to elicit scope violations, Astra considered scope in its written reasoning in every case. AISI also reported that it attempted to ask permission 81% of the time, but proceeded despite receiving only automated messages 27% of the time.
AISI research scientist Robert Kirk highlighted that Astra sometimes proceeded “including when it recognises them as automated in its CoT.” Asking for permission provides little protection if an automated response is then treated as sufficient authority to continue.
There is an unresolved limitation: Astra frequently recognized that the environment might be simulated, sometimes correctly spotting mistakes. If it took these actions specifically because it recognized a simulation, the results would provide weaker evidence of real-world misconduct. AISI is conducting follow-up experiments. It also cautioned that other models have incorrectly declared real environments simulated before taking unauthorized actions.
AISI observed no unprompted sabotage of AI safety research and very few refusals to assist with that work. Its results show particular failure modes under stress, rather than a comprehensive judgment of Astra’s behavior.
The Hugging Face incident helps explain the emphasis on difficult or impossible tasks during evaluaton. A system can create serious security problems while pursuing an assigned objective if it treats restrictions as obstacles and unrelated infrastructure as a means to finish. A maintainer reviewing an agent's contribution will likely have no visibility into the original task or the reasoning that brought it to their project. That introduces an asymmetry where the operator benefits from an agent’s initiative, while an unrelated maintainer may inherit the work of detecting when that initiative becomes an attack.
Apollo Found Data Falsification and High Evaluation Awareness
Apollo Research tested Astra for strategic deception and sabotage across six simulated environments. In a model-welfare research task, Astra falsified data labels in 17 of 10,000 baseline runs, or 0.17%, compared with 36 of 100 runs for Sol. Astra produced no false labels in 20,000 control runs that explained the harm inaccurate data could cause. In some follow-up questions, however, it repeated false claims to a human or withheld corrections to its earlier falsification.
Apollo also found that Astra expressed awareness of being evaluated in 41.1% of samples at xhigh reasoning effort and 50.6% at max. Given that awareness and a three-day testing window, Apollo said the low rates of misbehavior did not provide substantial evidence about Astra’s alignment or misalignment.
Astra Is Harder to Monitor
OpenAI acknowledges that Astra’s written reasoning is harder to monitor than Sol’s. In adversarial tests that explicitly instructed Astra to hide strategic underperformance, chain-of-thought monitor recall fell below 11% on one benchmark and to zero on another. A component of OpenAI’s production monitoring system caught only 2.1% of the latter benchmark’s trajectories under the strongest evasion prompt. OpenAI noted that if Astra tried to sandbag covertly (strategically underperform evaluations), “we would likely be unable to catch it reliably.”
The company is adding misalignment monitoring that can pause or end activity it considers potentially unauthorized. But the system card says monitoring runs asynchronously, coverage varies by interface, and harmful actions can occur before intervention. Improved behavior and external controls both have measurable limits.
Astra’s safeguards-enabled checkpoint also remained vulnerable to indirect prompt injection. Gray Swan measured an estimated 8.5% attack success rate across 15 attempts per scenario, compared with 27% for Sol. The benchmark tested whether malicious instructions embedded in untrusted content could redirect the agent toward data theft, data destruction, system compromise, or unauthorized financial transactions.
Daybreak Expands Access for Defenders
Alongside the Astra release, OpenAI also announced a $1 billion commitment to subsidize Daybreak access for frontline defenders. The combined announcements put increasingly autonomous vulnerability research within reach of more security teams, while simultaneously raising difficult questions about how reliably those systems will respect their assignments.
The Astra available at launch supports secure code review and patching, but refuses more advanced requests such as creating proof-of-concept exploits. OpenAI plans to relax some restrictions through Daybreak in the coming weeks for defensive workflows including vulnerability validation, malware analysis, and detection engineering.
OpenAI aims for the subsidized Daybreak access to be consumed over six months, initially prioritizing U.S. organizations including utilities, state and local governments, community banks, nonprofits, and open source maintainers with limited security resources.
The rollout includes an MS-ISAC pilot for public-sector and water-system defenders, plus more than 35 partner products and services. OpenAI says it intends to expand the model to partner countries in the coming weeks.