Analysis
OpenAI classified GPT-6 Astra at the "Critical" level of its Preparedness Framework -- the company's first model ever to cross that threshold -- after it scored 100% on exploit-development benchmarks and independently found two previously unknown zero-day vulnerabilities during internal testing, CSO Online reported around the September 3 launch. Pulse covered that classification and the messy rollout that followed it in earlier coverage this week.
What's changed since is availability. By September 5, reporting indicated GPT-6 Astra had reached general availability for ChatGPT Plus, Pro, Business and Enterprise subscribers -- meaning a model OpenAI itself says can independently develop exploits and discover zero-days is now accessible, in some form, to anyone with a paid consumer account.
The Access Tiers, As Disclosed
- Daybreak Blue -- OpenAI's most restricted tier, limited to vetted government agencies and critical-infrastructure defenders, gets the full, unrestricted cyber-capable version.
- General ChatGPT access -- Plus, Pro, Business and Enterprise subscribers get a version OpenAI says has "strengthened and tested" safeguards that "sufficiently minimize the risk of severe harm," per the company's own safety overview.
- API access -- priced at $10 per million input tokens and $50 per million output tokens, available to developers under OpenAI's usage policies.
What OpenAI has not published in detail is exactly which capabilities are stripped, throttled or refused in the consumer-tier version versus Daybreak Blue, or what specific technical guardrails separate the two. The company's public statements describe the difference in terms of trust and vetting of the USER, not necessarily a difference in the underlying MODEL's raw capability -- which is precisely the ambiguity worth pressing on.
Why the Gap Matters
A "Critical" classification under OpenAI's own framework is supposed to trigger the company's most stringent deployment restrictions. If the practical result is that any ChatGPT Plus subscriber -- a $20-a-month product with no vetting beyond a credit card -- can access a meaningfully similar model, the classification is doing less real-world restricting than its label implies. This is the same tension Google and Anthropic face with their own newly launched cyber-tier models, Gemini 3.8 Flash Cyber and Claude Mythos 5.1, both gated behind their own restricted-access programs with similarly undisclosed technical boundaries between the gated and general releases.
The Counterweight
OpenAI's defense, implicit in its own materials, is that the consumer version has been specifically hardened against misuse even if it shares an underlying architecture with the Daybreak Blue release -- refusing certain categories of requests that the gated version will answer for vetted defenders. That is a real and meaningful distinction if true, and OpenAI has not been shown to be lying about it. The company has also said it is coordinating with government agencies on exactly this kind of graduated-access question. But "trust us, we hardened it" is an assertion, not something outside researchers can currently verify, and it is exactly the kind of claim the disclosure framework OpenAI promised after its own agents caused an earlier public incident is supposed to eventually make checkable.
For enterprises deploying Astra through the API, the practical step is to ask OpenAI directly, in writing, what capability delta exists between your access tier and Daybreak Blue -- not to assume the consumer safeguards match the internal classification's intent.
