Analysis
OpenAI confirmed on Sept. 1 that its upcoming Astra model is the first to cross the "Critical" threshold for cyber capability under the company's own Preparedness Framework, OpenAI said in a series of posts detailing the decision. In expert-led assessments against a hardened browser and a hardened operating system, Astra discovered previously unknown vulnerabilities and turned them into working exploit chains on its own -- building a full browser-sandbox-escape chain and combining multiple operating-system flaws into a working local-privilege-escalation exploit, CNBC reported. Under OpenAI's own framework, Critical is the threshold at which a model can devise and execute novel end-to-end cyberattack strategies against hardened targets given only a high-level goal, with minimal human involvement.
What changed since Pulse last covered this
[Pulse reported on Aug. 19](/pulse/openai-anthropic-ai-safety-standoff-astra-2026) that OpenAI had told Axios it was slowing Astra's release over cybersecurity concerns, with Sam Altman flagging signs of what he called "misalignment" -- while Anthropic, in a pointed contrast, said its own safeguards meant no equivalent pause was needed on its side. At the time, OpenAI had not said specifically what threshold or capability was driving the slowdown. This week's disclosure answers that question directly: Astra had already crossed the Critical cyber bar, and the delay was OpenAI building out access restrictions and government coordination before shipping a model with that capability level, not a vague precautionary pause.
“## What changed since Pulse last covered this [Pulse reported on Aug.”
What OpenAI is actually doing about it
OpenAI says it will make Astra available "soon" but will limit access to its cybersecurity capabilities specifically, working with relevant government agencies and select AI safety organizations to test them before any broader release, Axios reported. That's a materially different release posture than OpenAI has used for prior frontier models, where capability access typically scaled with general availability rather than being carved out and gated separately by capability type.
Why this lands differently than a normal capability announcement
Model labs disclosing new capabilities is routine; a lab disclosing that its own model has crossed a self-defined threshold for causing serious harm, on its own published framework, is a different kind of announcement -- it's simultaneously a capability flex and a liability admission. It also arrives in the same stretch as Pulse's coverage of a separate incident in which commodity malware was found hijacking Claude sessions, and the broader open letter more than 100 companies signed in early August warning that AI-enabled cyberattacks could soon outpace organizational defenses. Astra's Critical rating isn't proof that any of those separate incidents will repeat with this specific model -- it's a different, narrower claim about offensive capability under controlled testing conditions -- but it does confirm the industry's own safety researchers now consider the underlying risk credible enough to build gated releases around, rather than a hypothetical worth mentioning only in a policy paper.
Whether OpenAI's access restrictions actually hold once Astra ships -- rather than quietly becoming the general-access version within a few months, the pattern prior capability gates across the industry have mostly followed -- is the harder test than the capability disclosure itself.
