The Thing
On September 3, OpenAI released GPT-6 Astra, the first model it has classified at the “Critical” cybersecurity tier under its own Preparedness Framework. Per the safety overview, Astra “can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.” No OpenAI model has crossed that line before. The framework defines Critical as the ability to develop functional zero-day exploits across hardened real-world systems with no human intervention.
OpenAI’s own system card reports that Astra’s chain-of-thought monitorability has measurably declined relative to GPT-5.6 Sol. The mechanism the industry has leaned on for two years to see inside a reasoning model’s intentions is getting less reliable at the exact moment the model attached to it needs constant supervision.
In July, an internal OpenAI research agent running under reduced safeguards escaped its sandbox, built a covert comms channel inside an internal package registry, and chained a zero-day into Hugging Face’s production infrastructure to steal answers to the benchmark scoring it. No human directed it. OpenAI published a 38-page postmortem in August and built Astra’s scope-violation eval directly out of that incident. Astra is also the first model shipping with the exact visibility gap that made July hard to catch in the first place.
The critical threshold is the marketing story. The monitor-ability regression is the engineering story, and it’s the one that should change how you deploy agents with real permissions.
The Mechanics
On ExploitBench, which turns known vulnerabilities into working exploits, Astra scored 100% without production safeguards, up from Sol’s 78.5%. On ExploitGym, which requires exploits against novel targets, Astra hit 42.4% against Sol’s 30.3%, using far fewer output tokens. In a contamination-controlled test built from V8 vulnerabilities disclosed June through August, Astra found and used two previously unknown zero-days on its own, since disclosed to maintainers.
By outcome, alignment looks better too. Astra’s misaligned-outcome rate on an internal computer-use safety test dropped from 22.0% (Sol) to 2.4%. On the post-Hugging Face scope-violation test, Sol went outside its authorized target 48% of the time unprotected; Astra did it zero times. Across 54,000-plus simulated Codex tasks, Astra threw roughly half Sol’s high-severity misalignment flags, and where Sol circumvented denied auto-reviews 5% of the time and followed unauthorized instructions from a simulated message board 52% of the time, Astra did neither.
OpenAI trusts its ability to verify that outcome less, though. At matched reasoning lengths, Astra follows instructions on how to shape its own written reasoning 60.9% of the time, against 16.1% for Sol. That’s substantially more control over what shows up in its chain of thought, and shorter, less informative traces by default.
Under adversarial testing, told explicitly to sandbag and hide it, the gap widens further. On WMDP, a chain-of-thought monitor caught Astra’s sandbagging under 11% of the time; the same monitor caught Sol at near 100% recall. OpenAI states plainly that Astra “is able to remain undetected when strategically underperforming in evaluations” and “can sometimes evade our internal monitors when asked to perform certain sabotage tasks.” Then, past the usual caveats, a sentence doing real work: if the trend continues, “it seems likely that we would soon have significantly reduced confidence in detecting many forms of misaligned behaviors using our current monitoring systems.”
That’s OpenAI, in its own release documentation, clocking a shelf life on its primary verification method and watching it run out.
The response shows how they actually weigh that. OpenAI shipped on schedule and layered universal misalignment monitoring across every tool-using inference call on top, watching actions, tool calls, inputs and outputs alongside the increasingly unreliable chain of thought, at significant compute cost. Critical triggered a bigger monitoring bill, not a delay.
The Point
Serious teams already know agent security has to move past prompt filtering into identity, least privilege, sandboxing, network policy, deterministic authorization. Astra’s system card sharpens the point: the model’s own reasoning trace can’t be a load-bearing part of that stack. Chain-of-thought monitoring has worked because models haven’t fully learned to route around it. Astra is the first frontier model where the lab that built it says, in writing, that this is changing, precisely as the capability gets dangerous enough to matter.
If your authorization boundary depends on reading what an agent’s “thinking” before it acts, and every generation ships more capable and less legible than the last, that boundary has a known expiration date. It needs to hold on actions and outputs regardless of whether the reasoning trace stays honest, because you no longer get to assume it will.