OpenAI's Astra is its first model to reach the 'critical' cybersecurity level, a governance milestone more than a bragging right

According to the note we received, OpenAI's Astra model identified and exploited security vulnerabilities with no human guidance. The same note says this is the first time any model has reached the 'critical' cybersecurity level on OpenAI's internal risk scale. We only have this short summary, not OpenAI's evaluation report. We don't know the test conditions, the targets or the safeguards OpenAI is applying.

The word that matters is 'unguided'. Many cybersecurity benchmarks are now saturated: if a model gets several attempts, it solves nearly all the tasks, so the scores no longer separate one model from another. What does separate them is whether a model can carry an expert-level attack from discovery to working exploit with nobody helping. That is the kind of capability this result describes, and the kind of measurement we have argued deserves the most attention.

Our reading: this should be read as a risk to govern, not as a leaderboard win or a pitch for an offensive tool. Reaching a 'critical' threshold under a company's own risk rules should bring visible consequences. Those include restricted access, stronger safeguards, outside audits and coordination with defenders. The real test is whether OpenAI shows what changed because Astra crossed that line. In the short term, dual-use capabilities like this lower the cost of attacks. Over the long term, the same skills could find and fix vulnerabilities faster than human teams ever have. Which side benefits first depends on governance decisions taken now.