OpenAI’s GPT-6 Astra becomes its first model rated Critical for cybersecurity
OpenAI's new GPT-6 Astra model has become the first in the company's lineup to receive a 'Critical' cybersecurity capability rating under its Preparedness Framework.
Alongside Astra, OpenAI has released a specialized sibling model called GPT-6 Cyber, which is already working with security teams at Mozilla, Palo Alto Networks, and Cisco. The company's internal testing from September 1-4, 2026, revealed that Astra can autonomously find and exploit zero-day vulnerabilities across complex systems and build complete cyberattack plans from high-level goals.
Performance and Discoveries
On the ExploitBench evaluation, Astra achieved a perfect score of 100%, significantly outperforming its predecessor GPT-5.6 Sol, which scored 78.5%. During testing, Astra identified two previously unknown zero-day vulnerabilities that will be disclosed to the affected software maintainers.
GPT-6 Cyber Deployment
Released on November 5, 2026, GPT-6 Cyber is a specialized variant designed for controlled vulnerability research and exploit validation, with access limited to vetted customers only. On the ExploitGym benchmark, it scored 48.5%, improving upon GPT-5.6 Cyber's 32.1%. The research team discovered 81 previously unknown high-severity vulnerabilities in Firefox and developed working exploits for 948 Linux kernel privilege escalations, with 588 being new discoveries.
Mozilla credited OpenAI in its Firefox 159 security advisory for the vulnerabilities found.
Risk Management Approach
OpenAI's Preparedness Framework grades model capabilities in sensitive areas, with 'Critical' representing the top of its risk scale. The company is implementing gatekeeping measures for the Cyber variant, restricting access to vetted customers and ensuring responsible disclosure of discovered vulnerabilities.
Lee Klarich, CPO and CTO of Palo Alto Networks, praised the model's effectiveness for defensive work, while Mozilla engineer Brian Grinstead echoed these sentiments, highlighting the practical benefits of AI-assisted security research.
Related
