The safety threshold that triggers a monitoring clause, not a shutdown
GPT-6 Astra crossed OpenAI’s “Critical” cybersecurity threshold, a label that adds oversight, not restrictions.
By The Signal · · 5 min read
OpenAI released GPT-6 Astra on September 3, 2026, and buried the most consequential fact in a document most readers will never open. The company's own Preparedness Framework — the internal rulebook it wrote to grade its models' capacity for harm — classifies Astra as "Critical" in cybersecurity. That is the top tier the framework defines. No OpenAI model has reached it before.
The number is one word, and the word is "Critical"
OpenAI's Preparedness Framework, published in 2023 and revised since, ranks models across categories — cybersecurity, biological and chemical weapons, and persuasion, among others — on a four-step scale: low, medium, high, critical. Astra is the first model OpenAI has publicly placed at critical for cyber capability. The company's safety overview, posted alongside the launch, states this outright: Astra "meets the Critical threshold under our Preparedness Framework," citing performance on ExploitBench, an internal test suite for exploit development, where Astra scored 100 percent.
A perfect score on a benchmark named for exploits is the kind of figure that reads like an alarm. It also comes from a test OpenAI designed, scores, and has not published in full. There is no independent audit of ExploitBench's difficulty, no outside lab replicating the 100 percent figure, and no public breakdown of which exploit classes the benchmark covers. The number is real in the sense that OpenAI reports it plainly. It is also the only figure available, from the only party with a stake in how it's framed.
Why "critical" sounds like a shutdown and isn't one
Under the framework as written, crossing "critical" is supposed to trigger a specific consequence: OpenAI has committed to not deploying a model that reaches critical risk in a category until it has implemented safeguards that reduce that risk to an acceptable level. Astra shipped anyway — to a limited set of enterprise customers immediately, with a wider rollout to ChatGPT Plus, Pro, Business and Enterprise users following within days. That is not a contradiction so much as a demonstration of how much interpretive room the framework leaves OpenAI. The company decides what counts as an adequate safeguard, and the company is also the one grading whether Astra cleared that bar.
The mechanism is closer to a building code than a fire alarm. A structural engineer can certify a building meets a fire-resistance rating and still let people move in — the rating changes what inspections and materials were required during construction, not whether the building opens. Astra's "critical" label works the same way: it describes a design threshold that shaped how OpenAI tested and constrained the model before release, not a public-facing restriction on what the model can now be asked to do.
What actually improved, measured in three unrelated tests
Strip away the AGI framing and the concrete claims are these: Astra scored 98 percent on FrontierMath Tier 4, a set of unsolved-until-recently mathematics problems; 99.9 percent on ARC-AGI-3, a reasoning benchmark designed to resist memorization; and 100 percent on ExploitBench. OpenAI also says Astra completed real-world computer tasks — booking DMV appointments, searching job listings, apartment hunting — faster than an average human tester in its own trials. None of these figures come with a comparison group size, a description of who the "average person" baseline was, or a third-party replication. They are OpenAI's tests, run on OpenAI's model, reported by OpenAI.
That doesn't make them false. Frontier Math's Tier 4 problems are genuinely difficult — OpenAI says Astra helped resolve open problems in the field, which is a falsifiable claim other mathematicians can check against published proofs. But a 98 percent score on a benchmark that didn't exist two years ago tells you Astra is good at a specific, gameable target, not that it reasons the way the "AGI" framing implies.
Brockman's claim is a prediction, not a measurement
OpenAI president Greg Brockman told reporters at a press briefing that he believes "we are now in the AGI era," and that looking back in a few years, this model might mark when it started. That is a forecast about how history will be written, not a technical claim with a unit attached. Nothing in the safety overview or the benchmark results OpenAI published defines "AGI" or measures against a threshold for it. The company that would profit most from investors, enterprise customers and an eventual IPO believing that threshold has been crossed is the same company making the claim, unverified by any external body.
The more measurable statement, made by chief scientist Jakub Pachocki in the same briefing, cuts the other way. Pachocki said OpenAI monitors Astra's chain-of-thought — its internal reasoning trace — to catch misalignment, and that this kind of visibility is becoming harder to maintain as capability rises. He went further: OpenAI would "withhold scaling" if it lost confidence in its ability to monitor a model's alignment. That is a specific, checkable commitment, unlike "AGI era." It also means the company is naming the thing that could stop the next model, before it ships one.
The constraint is a promise about what OpenAI won't build next
The practical change for most users lands in Codex, OpenAI's coding tool, where Astra introduces persistent notes across long sessions — a way to avoid re-summarizing earlier debugging context every time a conversation exceeds its context window. Instead of compressing accumulated detail into a single lossy summary, Astra can keep granular notes and search earlier context directly. That is a real engineering fix for a documented failure mode: long-context compaction has always dropped details about why an earlier fix failed, and developers have complained about re-explaining themselves to models for years. It ships as an opt-in feature now, becoming default "in the coming weeks."
The cybersecurity classification matters less for what Astra can do today — access remains gated to paying organizations, with enterprise administrators required to switch it on — and more as a marker for what comes after it. OpenAI has now put in writing that a model exists which it internally rates as capable of critical-level cyber harm, that it shipped it anyway under safeguards it alone verified, and that its own chief scientist says the tooling to monitor the next one might not keep up. The framework's real test isn't Astra. It's whether "we would withhold scaling" holds the first time the monitoring genuinely fails — and who outside OpenAI would be in a position to know.