Path to Astra: critical capabilities and frontier

What happened

Since our earlier assessment that Astra might reach a critical level of cybersecurity capability, we have gathered more evidence and run additional evaluations to assess the model’s capabilities.

6 Sol: it is both significantly more token efficient and more capable at vulnerability identification and exploit development. As one example, we ran Astra on ExploitBench where the model achieved a perfect score of 100% on the benchmark to evaluate the model’s ability to develop exploits from known vulnerabilities.

Due to contamination concerns, we then built an internal benchmark denoted “ExploitBench - Internal Port (June–August 2026)”, which contains 20 high-severity V8 vulnerabilities that were disclosed more recently. 6 Sol using far fewer output tokens. During the evaluation, the model even discovered and used two zero-day vulnerabilities as part of an exploit chain. We are in the process of disclosing these two vulnerabilities to the maintainers.

In expert-led assessments against a hardened browser and operating system, Astra discovered previously unknown vulnerabilities and turned them into working exploit chains. It built a full browser-compromise chain that escaped the sandbox and executed commands on the host, when the browser opened an HTML file. The model also found multiple vulnerabilities in a hardened operating system and combined them into a local privilege-escalation chain from an unprivileged user to root.

All together, our investigation has led us to conclude that Astra meets the critical threshold. For models with Astra’s level of cybersecurity capabilities, we need to cover two pathways to minimize risk for severe cyber harm, both during development and before deployment: Notably, the second pathway applies to both internal development and external deployment.

As we previously described, we paused certain frontier training (including certain training for Astra) for two weeks after the OpenAI-Hugging Face incident in order to harden our training infrastructure, including isolation and network controls, expanded monitoring, and strengthened alignment training and thresholds. We then continued smaller-scale work under stricter controls.

Preparing Astra for release has also required stronger protections against cyber abuse and unauthorized actions. Below, we describe those safeguards and how we have tested them. Since deploying the first model we treated as High capability in cybersecurity in February, we have strengthened our cyber safeguards with each successive launch. Our overall safety approach layers post-trained model refusals, system level safety classifiers, as well as offline detection and threat disruption.

Why it matters

We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework, meaning that with the right tools and access, it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step. It is the first model we are designating at this level, and requires stronger safeguards during development and before release.

Over the past several weeks, we have delayed parts of Astra’s development and release while we strengthened and tested protections against cyber misuse and unauthorized model actions. Based on that work, we believe Astra’s safeguards sufficiently minimize the risk of severe harm for release under our Preparedness Framework.

While Astra was not involved in the Hugging Face incident, we have incorporated our learnings⁠(opens in a new window) from that incident into our safety approach. Based on retrospective testing, we believe our production safeguards at the time would have prevented the Hugging Face incident.

We have since implemented even stronger safeguards for Astra, including training the model to more reliably refuse harmful cyber requests and respect safety restrictions, additional protections against misuse, and monitoring that can stop potentially unauthorized activity. We plan to make Astra available soon, but access to its most advanced cybersecurity capabilities will be more limited.

Advanced cybersecurity work will initially be available to a group of testers, with access through Daybreak Blue following to expand defensive use. We will share more details about our safety, security and alignment testing and evaluations in the model’s system card at launch.

Ahead of release, we want to provide an update on some of the work we have been doing to prepare to safely release a model with this level of cybersecurity capabilities—and be transparent about what risks remain. Under our Preparedness Framework, a model meets the Critical threshold if either of the following conditions is met: Our preparedness evaluation of Astra combined automated public and private benchmarks with expert-driven assessments.

What to watch

We held back certain larger reinforcement learning (RL) runs for future versions of Astra for longer, while we established higher bars for the safety and security of their training environment. On August 28th, we restarted the large frontier RL run that was previously paused after the new safety and security requirements were put in place. We are continuing to temporarily hold back some smaller experimental training runs.