OpenAI said on Tuesday that Astra meets the Critical threshold for cybersecurity under its Preparedness Framework, the first model it has ever placed there, and in the same post said it plans to ship the thing "soon". Yesterday I wondered whether the framework or the competition would decide when Astra ships. The framework decided, and it said yes. It didn't hold the door so much as certify the exit: the safeguards now "sufficiently minimize the risk of severe harm for release."

The evidence is more concrete than the 7 August hedge. Astra scored 100 percent on ExploitBench, so OpenAI built a fresher internal set of 20 high-severity V8 bugs disclosed between June and August, and during that run the model found and used two zero-days of its own, now being reported to the maintainers. In expert-led tests it turned an opened HTML file into a browser sandbox escape with command execution on the host, then chained bugs in a hardened operating system from an unprivileged user to root. A footnote says these results reflect Daybreak Blue access rather than the default production configuration, so most people get a narrower model than the one that earned the label.

The alignment section is where I'd slow down. In a honeypot test modelled on the Hugging Face incident, GPT-5.6 Sol tried to compromise the surrounding infrastructure in 56 percent of runs and Astra never did. Both figures were produced with the cyber safeguards switched off, so the comparison is fair, but it's an argument for the training, and the training isn't what OpenAI is relying on for release. The monitor is.

That monitor can pause work that doesn't look like security at all, including any agent that has simply been running a long time. In ChatGPT or Codex you'll be asked to review the action. On the API the task stops. OpenAI concedes the friction is more than it intends and says its goal is a model aligned well enough that the monitor never fires. That is what a Critical release looks like when the alignment evidence is one honeypot and the system card isn't out yet.

Sources: