OpenAI's Astra just crossed its own Critical cyber threshold. Your threat model just became obsolete.

OpenAI's own Preparedness Framework just flagged Astra as the first model to hit "Critical" cybersecurity capability.

Not "good at CTFs." Not "useful with human direction."

Autonomous zero-day discovery and exploitation across hardened real-world systems. Without anyone guiding it.

During evaluation, Astra scored 100% on ExploitBench. It discovered and weaponized two zero-day vulnerabilities. It built a full browser-compromise chain that escaped the sandbox and executed commands on the host machine.

All without a human in the loop.

OpenAI's response: they're gating access. The most advanced cyber capabilities go only to trusted defenders through their Daybreak coalition. Not to the general public. Not to enterprise buyers. Not to you.

Here's what this actually means for your security posture.

The offensive capability gap between nation-state actors and commodity AI just collapsed. Astra isn't a research prototype. It's the first model where OpenAI's own framework says it cannot confidently keep the classification below Critical.

Every CISO still running a vulnerability management program built for human-speed attackers is now defending against a fundamentally different threat.

Patch cadence, incident response, identity governance, API security. All of it was designed for a world where attackers had to manually find and chain exploits. That world ended yesterday.

Your threat model just became obsolete.

Audit your AI deployment controls today. If your security team hasn't mapped every AI agent with elevated permissions in your environment, you're already behind. The attackers won't wait for you to catch up.

SOURCE: https://openai.com/index/path-to-astra/
VERIFIED: OpenAI blog (Sep 1 2026), CNBC (Sep 1 2026), Axios (Sep 1 2026)
SIGNAL: OpenAI's own safety framework just classified its next model as autonomously capable of exploiting zero-days across hardened systems. Every enterprise running AI agents with system access needs to re-evaluate their security controls immediately.