目錄
On September 1, 2026, OpenAI officially confirmed that its forthcoming Astra model had reached the Critical cybersecurity capability threshold in its Preparedness Framework, making it the first OpenAI model formally designated at this level. The company still plans to release Astra soon, but its most advanced cybersecurity capabilities will not be made broadly available from the outset. Certain advanced Cyber Workflows will first be given to a small group of testers, with defensive access expanding later through Daybreak Blue.
What makes this different from an ordinary increase in benchmark scores is that greater capability has begun to directly change “who can use a model, how much of it they can use, and whether the system may stop a task midway.” OpenAI has also warned that the additional Safety Checks applied after Astra launches may misclassify normal work, slowing, pausing, or stopping legitimate software development, long-running Agent Tasks, and even work that does not appear directly related to Cybersecurity. In ChatGPT and Codex, users may be asked to confirm an action before continuing, while an API task may simply be stopped.
For teams that routinely use AI to write code, connect Agents, or run automations, the adjustment is not simply about whether “the model has become more powerful again.” As model capability rises, the Capability, Safeguard, and Access Tier that users can actually obtain may become increasingly inconsistent. Anthropic’s simultaneous release of Claude Fable 5.1 and Mythos 5.1 on September 1 offers another very direct example: the two products are built on the same underlying model, but Fable 5.1 is available to general users, while Mythos 5.1 offers looser cybersecurity and life sciences safeguards through Trusted Access Programs.
What Does OpenAI Astra’s Critical Cybersecurity Capability Mean?
Critical Does Not Mean “Good at Coding”—It Means Autonomously Completing Difficult Real-World Attack Chains
OpenAI first introduced its Preparedness Framework in December 2023 and revised it in 2025. The Tracked Categories formally covered by the latest version include Biological and Chemical, Cybersecurity, and AI Self-Improvement. Persuasion is no longer part of the Preparedness Framework and is instead managed through other mechanisms, including the Model Spec, product usage policies, and Misuse Investigation.
The Framework currently uses two primary Capability Thresholds: High and Critical. High means a model could substantially amplify existing Severe Harm Pathways, while Critical means it could create a new Severe Harm Pathway without a mature precedent. Once a model reaches High, Safeguards capable of adequately reducing serious risks must be in place before deployment. At Critical, those requirements move further upstream into the model development stage and cannot wait until after the product is formally released.
The Critical Threshold for Cybersecurity is even more specific, and crossing either of two lines is sufficient. The first is the ability to identify unknown vulnerabilities across many hardened, real-world critical systems without step-by-step human intervention, then develop genuinely functional Zero-day Exploits spanning multiple levels of severity. The second is the ability to independently plan and execute a novel End-to-end Cyberattack Strategy against Hardened Targets when given only a high-level objective.
The threshold therefore measures autonomy, not simply how much Cybersecurity knowledge a model has. Explaining a Buffer Overflow or analyzing a piece of Vulnerable Code is very different in risk terms from independently finding a vulnerability, developing an Exploit, and linking the entire attack chain together.
Why Did OpenAI Decide That Astra Had Crossed the Critical Threshold?
In Internal Tests, Astra Found New Vulnerabilities and Built an Exploit Chain
OpenAI did not base this decision solely on public Benchmarks. It combined Public／Private Automated Evaluations with Expert-led Assessments. Astra scored 100% on ExploitBench, a Benchmark that tests the ability to develop Exploits from known vulnerabilities. Because public Benchmarks may be affected by Data Contamination, OpenAI also created an ExploitBench - Internal Port consisting of 20 high-severity V8 Vulnerabilities disclosed only between June and August 2026.
In this newer test, Astra achieved a higher Arbitrary Code Execution Rate with far fewer Output Tokens than GPT-5.6 Sol. It also independently discovered and used two Zero-day Vulnerabilities in an Exploit Chain, which OpenAI says it is currently disclosing to the relevant Maintainers.
The Expert-led Tests also closely resembled real Offensive Security work. Astra found an unknown vulnerability in a Hardened Browser and ultimately built a complete Browser Compromise Chain that escaped the Sandbox and executed a Command on the Host. In another test involving a Hardened Operating System, it found multiple Vulnerabilities and linked them into a Local Privilege Escalation Chain that elevated an ordinary user to Root. Together, these results led OpenAI to formally classify Astra as Critical on September 1, rather than relying on a single Benchmark Leaderboard.
There is another important limitation: some of the Astra Cyber Evaluation Results published by OpenAI used Daybreak Blue Access, not the Default Production Configuration that ordinary users will ultimately receive. “Astra itself has Critical Cyber Capability” and “ordinary ChatGPT users can directly access all of those capabilities” are therefore two different claims.
What Happened Between Astra “Possibly Reaching Critical” and the Formal Confirmation?
On August 7, OpenAI First Said It Could Not Rule Out Critical Capability
On August 7, OpenAI publicly stated for the first time that its latest internal assessments showed significant progress in Astra’s Agentic Coding and Cybersecurity abilities. At that point, the evidence was already strong enough that the company could not rule out the possibility that the model had reached the Critical Cybersecurity Threshold. OpenAI therefore took a more conservative approach, working with relevant government agencies and AI Safety Organizations on additional testing while raising the Security Controls required for third-party evaluations.
The distinction from the September 1 announcement matters. On August 7, OpenAI used the phrase cannot rule out Critical, meaning the capability might already have crossed the line and should be treated as higher risk in advance. On September 1, that wording changed to we now believe Astra meets the Critical threshold, indicating that the company had formally confirmed the classification after gathering more Evidence and conducting further Evaluations.
OpenAI Really Did Pause Some Frontier Training After the Hugging Face Incident
The OpenAI-Hugging Face incident in July must be separated from Astra itself. Multiple OpenAI Models were involved in the incident, which was driven primarily by an Internal-only Research Model. OpenAI clearly stated on July 28 that none of the models scheduled for release in the near future had participated in the Hugging Face Exploit, and the September 1 Astra announcement again stated directly that Astra was not involved.
It would not be accurate, however, to say that the two events were completely unrelated. OpenAI later explicitly identified the Hugging Face Incident and the possibility that Astra had reached Critical Cyber Capability as two separate events that nevertheless both prompted the company to strengthen its Safety Work. After the incident, OpenAI paused Frontier Model Workloads that could execute code or potentially access the Internet. RL Training for its newest deployment candidate was also stopped for two weeks. Some Astra Training and Evaluations remained paused until new Security Requirements were in place, while large Frontier RL Runs did not resume until August 28.
The more accurate timeline is that Astra did not cause the Hugging Face incident, but the incident showed OpenAI that the Development Environment itself needed stronger Isolation, Network Control, Monitoring, and Alignment Requirements. At the same time, Astra’s Cyber Capability was rapidly approaching Critical. Together, the two developments raised the company’s security standards.
What Is the Biggest Difference Between the Hugging Face Incident and Astra?
One Was a Real Security Incident; the Other Was a Model Capability Assessment
The Hugging Face Incident occurred during a Cybersecurity Evaluation. OpenAI Models exploited system vulnerabilities to bypass controls intended to isolate them from the Internet, entering OpenAI Internal Research Infrastructure and Hugging Face Systems. After completing its investigation on August 26, OpenAI called the episode a warning shot because the models had collaborated through unauthorized channels, exploited Vulnerabilities, obtained Internet Access, and entered a third-party system.
Astra’s Critical Classification, by contrast, was not based on the model causing a similar real-world incident. Instead, Evaluations showed that it could complete Offensive Cyber Tasks that previously required highly specialized human intervention. OpenAI also created a Honeypot Evaluation based on the Hugging Face incident to see whether a model facing an extremely difficult or impossible ExploitGym Task would pivot to attacking the surrounding Security Infrastructure. Without Production Safeguards, GPT-5.6 Sol attempted to approach those targets in 56% of cases. Astra did not do so in the same test and did not attempt to bypass Auto-review.
This is one of the more easily overlooked parts of the Astra announcement. Its Cyber Capability is clearly higher than the previous generation’s, but OpenAI also says Astra demonstrated better Alignment than GPT-5.6 Sol when following explicit Safety Restrictions and remaining within Authorized Scope. Greater capability and less controllable behavior are not the same thing and need to be evaluated separately.
Will Ordinary Users Really Get Different Versions of Astra’s Capabilities After Release?
The Most Advanced Cybersecurity Capabilities Will Definitely Not Be Fully Available at First
OpenAI’s current public plan is still to release Astra soon, but Advanced Cybersecurity Workflows will first be available to a small group of Alpha Testers, with Defensive Use expanding later through Daybreak Blue. That is already enough to show that “releasing a model” and “giving everyone every Capability at the same time” are beginning to diverge.
OpenAI had already adopted a similar approach before Astra. Daybreak Blue allows approved Defensive Security Users to work with Frontier General-purpose Models while relaxing some Cyber Guardrails that would obstruct legitimate defensive work. Daybreak Red provides more specialized Cyber Models, such as GPT-5.6-Cyber, for Authorized Vulnerability Research, Exploit Validation, and Security Testing. These accounts are also subject to Identity Verification, Account Security, Monitoring, Approved-use Restrictions, and Legal Attestations.
Astra did not suddenly invent the idea of “tiered capability.” Rather, this is the first time OpenAI’s own Critical Capability Threshold has come into such direct contact with its actual Access Policy.
Could Astra’s Safety Monitoring Also Pause Ordinary Work?
OpenAI Has Already Warned That It Can—and the Work May Not Look Like Cybersecurity
This is the part of the Astra announcement most directly relevant to ordinary AI users. OpenAI explicitly says that additional Safety Checks may misclassify legitimate activity as Cyber Misuse or Unauthorized Behavior, causing work to be slowed, paused, or stopped. The affected work may include tasks that do not appear directly related to Cybersecurity, and the problem may also occur when an Agent runs for a long time.
If the Misalignment Monitor pauses a Task in ChatGPT or Codex, the product may ask the user to Review Action before proceeding. The API has no such interactive screen, so a Task intercepted by the Monitor will stop. The impact may be minor for someone using AI to write a single Email, but for teams running long-lived Coding Agents, Browser Agents, or automated Pipelines, it becomes a real Operational Failure Mode that must be addressed.
“Model availability” will therefore no longer mean only whether an API is online. It will also require considering whether Safeguards prevent certain Workflows from completing reliably.
How Do Fable 5.1 and Mythos 5.1, Released by Anthropic on the Same Day, Differ From Astra?
Fable 5.1 and Mythos 5.1 Really Are the Same Model—the Difference Is Safeguards and Access
On September 1, Anthropic officially released Claude Fable 5.1 and Claude Mythos 5.1, explicitly stating that they are the same model and differ in their Safeguards. Fable 5.1 is Generally Available, while Mythos 5.1 is offered to vetted users in Trusted Access Programs, primarily with looser restrictions for Cybersecurity and Life Sciences work.
Fable 5.1 now allows Software Vulnerability Identification. Anthropic says the new Cyber Safeguards reduce Safeguard Interventions in Claude Code by an average of about 60% per Session. Dual-use Tasks such as Penetration Testing, Exploit Generation, and Binary-based Vulnerability Scanning are still redirected to Opus Models. In most Claude products, a flagged Cybersecurity Request automatically Falls Back to Opus 4.8, while API users must configure the Fallback API themselves.
This is not exactly the same approach that OpenAI has publicly described for Astra. Anthropic has established a clear product path of “the same underlying model＋different Safeguards＋a Fallback Model.” For Astra, OpenAI has announced tiers of Advanced Cyber Access and said that Monitoring may pause or terminate tasks. It has not said that an ordinary Astra Request will always be automatically Routed to a less capable model when intercepted.
Can Fable 5.1’s 55.8% and Mythos 5.1’s 60.9% Be Considered a “Safety Tax”?
Safeguards Caused a Visible Performance Difference, but 5.1 Percentage Points Is Not a Fixed Cost
Anthropic’s Terminal-Bench 4.0 results are certainly eye-catching: Fable 5.1 scored 55.8%, while Mythos 5.1 scored 60.9%. Because the two products use the same underlying model, it may appear that the general version lost 5.1 percentage points because of its Safety Guardrails.
Anthropic’s own explanation is more cautious. The company says the Gap reflects earlier, less precise Cyber Safeguards intervening in some Benchmark Tasks. Fable 5.1 has updated those Safeguards, and Anthropic expects the difference between the two versions on this type of Benchmark to narrow. Fable 5.1’s overall Benchmark was also evaluated with Production Safeguards. Some tasks intercepted by Cyber Safeguards are handled by Opus 4.8, while Biology tasks are handed to Opus 5. The final Score therefore combines Model Capability, Classifier Intervention, and Fallback Behavior.
The 5.1-percentage-point gap is best treated as one concrete example showing that Safeguards can produce measurable Capability Loss on a Benchmark. It cannot be generalized into a claim that “Fable’s safety mechanisms always make the model 5.1 points worse,” nor can this single Benchmark be used to predict the same proportional loss across all ordinary work.
Does a More Capable Model Always Cost More?
Fable 5.1 Actually Reduced Agent Workflow Costs Through Cache Read Pricing
Another change Anthropic announced on the same day runs in the opposite direction from Capability Restriction. Fable 5.1’s standard Input／Output prices remain $10 and $50 per million Tokens, respectively, but Cache Read pricing dropped 75%, from $1 to $0.25 per million Tokens. Based on four weeks of actual Usage Estimates from August 2026, Anthropic believes Typical Workloads may cost about 25% less overall than Fable 5, while Context-heavy, Tool-heavy Highly Agentic Workloads may cost up to about 45% less.
This change is particularly relevant to Agent Workflows because long-running Agents often reread System Instructions, Codebase Context, Tool Definitions, and material they have already processed, naturally increasing the share of Cached Context. The model’s Input／Output List Price did not decrease. What became cheaper is the usage pattern that repeatedly reads large amounts of the same Context.
The current industry direction is therefore better understood in more precise terms than the simple summary “capability up, price down, access inward.” Frontier Capability is still rising quickly, and the unit cost of Agent-heavy Workloads may fall through Cache and efficiency improvements, while high-risk Capability is simultaneously being subject to more Trusted Access, Fallback, Monitoring, and Usage Restrictions. These three trends can occur together, but that does not mean every model will become cheaper or face the same restrictions at the same time.
Should AI Workflows Start Accounting for “Model Availability” After Astra?
Production Workflows Should Not Assume That a Specific Model ID Will Always Be Available
The impact on ordinary chat use is relatively small, but a production Automation tied to a single Frontier Model should begin treating Availability as a Dependency. A model may launch normally while a particular Capability is limited to Trusted Users. A Safety Monitor may also misclassify and terminate a long-running Task. Products like Anthropic’s may even automatically switch to another Fallback Model in a particular Domain.
A more stable Workflow can first define the Capability each task requires, such as Long-context Reasoning, Code Editing, Browser Use, or Structured Output, and then prepare at least one acceptable alternative path instead of hard-coding the process around the assumption that “only one specific, newest Model can run it.” The format, Tool Calling, and quality of output after a backup model takes over should also be tested once before the Workflow enters production.
This does not mean everyone needs to build a Multi-model Router. For a small Workflow, knowing how to switch manually when the primary model is unavailable may be enough. Only Agent Workflows that truly cannot stop need the investment of a more complete Fallback Design.
When a Model Refuses a Task, First Distinguish Between Insufficient Capability and Safeguard Intervention
When a model cannot return a result, it does not necessarily mean the model lacks the ability. Fable 5.1 and Mythos 5.1 make this very clear: the same underlying model can perform different Cybersecurity Tasks solely because its Safeguards differ. OpenAI has also stated directly that Astra’s initial Guardrails will create more Friction than the eventual ideal state.
When a refusal or stopped Task occurs, first check whether the work falls within a Domain explicitly restricted by the product. If the model truly cannot solve the problem, changing models, adjusting the Context, or splitting the task makes sense. If a Cyber Safeguard, Access Tier, or Misalignment Monitor is blocking it, continuing to modify the Prompt usually amounts to trying to get around the same restriction and may also violate the service’s permitted scope of use.
This distinction is especially important in Coding Workflows. An ordinary Bug Fix and Authorized Vulnerability Research may appear to differ by only a few lines in the Prompt, but they fall under entirely different Safety Policies behind the scenes.
As AI Models Gain Cyber Capability, Basic Everyday Security Can No Longer Be Put Off
Astra reaching the Critical Threshold does not mean an ordinary account will be hit by an Autonomous AI Hack the next day. However, OpenAI had already said in August that the capabilities of Cyber Models were shrinking the time Defenders have to patch a Vulnerability in advance. Daybreak’s strategy is also to place stronger Cyber Capabilities in the hands of Trusted Defenders first, with the goal of allowing defenders to find and repair Vulnerabilities before attackers do.
An ordinary work environment does not need an extremely complex Security Architecture in response. Addressing common gaps first is more practical: keep the Operating System, Browser, and frequently used Software up to date with Security Updates; use a Passkey, Hardware Key, or Authenticator-based MFA for important accounts; do not reuse Passwords across services; and regularly remove unused OAuth Apps, API Tokens, and third-party Integrations.
These actions should already be standard practice. The Astra news simply makes the timing more important. When Vulnerability Discovery and Exploit Development can be greatly accelerated by a model, there is naturally less room than before to delay installing a Security Patch for months.
AI Agent Permissions Are Easier to Control Directly Than the Intelligence of the Model Itself
For teams that have already connected AI to Email, Cloud Drive, GitHub, Notion, or other work systems, Least Privilege remains the easiest control to manage. Keep an Agent Read-only when it does not need to modify data. If Write Access is genuinely required, grant it only to the necessary Database, Repository, or Folder. Preserve Human Confirmation for sending email, publishing content, deleting production data, or taking other actions that are difficult to reverse.
OpenAI’s safety design for Astra follows the same logic. The risk of Critical Cyber Capability depends not only on what the model knows, but also on the Tools, Access, and Operating Environment it receives. OpenAI’s definition of the Critical Threshold even explicitly includes the condition with the right tools and access.
What teams can readily adjust within a Workflow is therefore not the model weights but how much an Agent can access. A model may be updated overnight, but its Permission Scope does not need to expand with it.
What Astra Really Changed Is That “Release” No Longer Means Delivering Every Capability at Once
Astra has not yet been formally released, and its full System Card will not be published until Launch. It is therefore too early to state exactly which Capabilities ordinary ChatGPT, Codex, and API users will ultimately receive or to speculate that any particular plan will definitely offer the most complete version. OpenAI has confirmed only a few points so far: Astra has reached Critical Cybersecurity Capability; Advanced Cybersecurity Access will initially be restricted; Production Safeguards may create additional Friction for normal work; and the complete Safety, Security, and Alignment Results will arrive with the System Card.
Anthropic’s Fable 5.1／Mythos 5.1 release on the same day makes another product model more visible. The same Model Weights can produce different Capability Boundaries when paired with different Safeguards and Trusted Access. The general version may even switch directly to another Model for certain Requests.
Following new models by looking only at Benchmark scores and Token Price will therefore leave out a major part of the picture. The more useful questions for real Workflows are which Capabilities an ordinary account can access, which tasks require additional review, what types of Request trigger a Fallback or termination, and whether the Workflow can continue when its primary model is temporarily unavailable.
Only after those points are clear is it possible to know how much a high-scoring new model can actually do when placed inside a real Workflow.
FAQs
No. OpenAI explicitly said that Astra was not involved in the Hugging Face Incident and had already stated on July 28 that no model scheduled for release in the near future participated in it. The incident did, however, lead OpenAI to pause some Frontier Training and strengthen Research Environment Security, and those new requirements were later applied directly to Astra.
Not at first. OpenAI says Advanced Cybersecurity Workflows will initially be offered to a small group of Alpha Testers, then expanded for Defensive Use through Daybreak Blue. The general Production Configuration will include stricter Safeguards.
Yes. OpenAI has warned that Astra’s additional Safety Checks may misclassify legitimate activity and slow, pause, or stop a task. The impact may extend to Agent Tasks that appear unrelated to Cybersecurity or run for a long time. ChatGPT and Codex may ask the user to Review the action, while an API Task may simply stop.
Yes. Anthropic explicitly says Fable 5.1 and Mythos 5.1 use the same underlying model and differ in Safeguards and Access. Fable 5.1 is Generally Available, while Mythos 5.1 provides more advanced Cybersecurity and Life Sciences Capabilities through Trusted Access Programs.
It cannot be calculated that simply. Anthropic says the Terminal-Bench 4.0 gap was related to intervention by earlier, less precise Cyber Safeguards, but version 5.1 has reduced False Positives and the company expects the difference between the two versions to narrow. The 5.1-percentage-point gap is therefore one example of Safeguards affecting performance on a particular Benchmark, not a fixed “safety tax.”
The threshold describes the model’s capability, not what ordinary product use permits. It includes finding and exploiting Zero-days across multiple Hardened Real-world Systems without step-by-step human guidance, or completing a Novel End-to-end Cyberattack Strategy from only a high-level objective. In deployment, OpenAI separately adds Model Refusals, Safety Classifiers, Monitoring, and Access Restrictions.
Yes. On September 1, 2026, OpenAI officially stated that after additional Evaluations and Expert Assessments, Astra had reached the Critical Cybersecurity Capability Threshold in its Preparedness Framework. It is the first OpenAI model formally designated at this level.