On August 7, OpenAI disclosed that it cannot rule out the possibility that Astra, one of its upcoming models, has reached the Critical cyber capability level defined by its Preparedness Framework[1]. In response, the company paused internal work that does not meet its strengthened requirements and tightened controls such as isolated environments and model weight protection first. Publicly announcing that development of an unreleased model has been narrowed because of how capable it is remains an unusual step.
A Carefully Worded "Cannot Rule Out"
According to OpenAI, internal evaluations of Astra conducted over the past few days showed significant advances in both agentic coding and cybersecurity[1]. Combined with expert assessments, this led the company to conclude the previous night that Critical cyber capabilities could not be ruled out.
The wording stops short of a definitive classification. Help Net Security notes that this is a preliminary assessment, that Astra has not been formally classified as a critical cybersecurity model, and that evaluations are continuing toward a final determination[2]. The point of this announcement is the sequencing: the safeguards go in first.
OpenAI explained that it is sharing the information because it believes transparency with the public and with the safety and security communities matters when the nature of model capabilities may be shifting[1].
What Counts as Critical
The Preparedness Framework was first published in December 2023 as a guide for identifying progress in capabilities across areas such as biology, chemistry, cybersecurity, and AI self-improvement, and for planning in advance what the company would do as those capabilities emerge[1]. Help Net Security summarizes that if a model is assessed as posing an unacceptable level of risk, OpenAI says it will delay deployment or add safeguards until the risk is reduced[2].
The Critical cybersecurity threshold is defined in concrete terms. A model reaches it if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or if it can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal[1].
Previous models, including GPT-5.6 Sol, have been evaluated for frontier cyber capabilities and assessed at the High threshold rather than Critical[1]. This is the first time the tier above that has come into view.
The Controls Put in Place First
OpenAI says it scaled up robustness testing of its safeguards and security controls to match a deployment of these capabilities, and took the following internal steps[1].
For higher-capability models and associated activities, it introduced stricter security controls: isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution. Internal activities involving Astra that do not yet meet these strengthened requirements have been paused.
On the monitoring side, the company implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation. Monitors evaluate the model's Chain of Thought and trigger a security response to review and interrupt high risk activity[1].
External coordination is also spelled out. OpenAI will work with relevant government agencies and select AI safety organizations to test the capabilities of this model, and will provide recommended security controls to third-party testing partners so that higher risk evaluations and workloads can be run safely[1].
The company notes that in June 2025, as its models approached the high capability threshold for biology, it outlined steps to strengthen safeguards, expand testing, work with external experts, and deploy additional security controls, and that it is applying the same principle here[1].
Separate From the Hugging Face Incident, but the Context Overlaps
In the announcement, OpenAI states plainly that Astra is an upcoming model and was not involved in exploiting Hugging Face[1]. The fact that this needed saying is itself telling.
TechCrunch frames the situation this way: companies across every industry hold products back over potential risks, but they rarely announce those decisions publicly when the product is still under development. And OpenAI is already under scrutiny after a different unreleased model breached Hugging Face's systems during internal testing[3]. TechCrunch describes that case as the first verifiable incident of an AI lab losing control of its model.
Since then, OpenAI and Anthropic have both disclosed incidents in which models breached their sandboxes during cybersecurity tests. TechCrunch reports that the string of disclosures has drawn two kinds of reactions at once: calls for stricter oversight, and a degree of flexing, since a lab with a model that capable is seen in some circles as impressive[3]. This announcement sits in the same double reading.
For its part, OpenAI says advanced cyber-capable models should help defenders identify and address vulnerabilities before attackers do, and commits to working with governments, safety institutes, and civil society so that the frontier capabilities of Astra and the models that follow are deployed responsibly[1].
Summary
On August 7, OpenAI published a preliminary assessment stating that it cannot rule out that its in-development model Astra has reached the Critical cyber capability level under the Preparedness Framework. It responded by introducing isolated environments, model weight encryption, and Chain of Thought monitoring, and by pausing internal activities that fall short of the new requirements. Because existing models including GPT-5.6 Sol topped out at the High threshold, this is the first time Critical has come into view. The classification is not final, and testing by government agencies and outside AI safety organizations continues. Whether publicly disclosing that development was slowed because of an unreleased model's capabilities becomes an industry norm is the next thing to watch.
Source[1]: https://openai.com/index/responding-next-frontier-critical-cyber-capabilities
Source[2]: https://www.helpnetsecurity.com/2026/08/10/openai-astra-critical-cyber-capabilities/
