OpenAI: Astra may have reached a "critical" network capability threshold, and did not participate in the recent Hugging Face security incident.

OpenAI published a new blog post noting that internal tests have shown its upcoming Astra model has made significant advances in agent coding and cybersecurity. Evaluated against its Preparedness Framework, OpenAI stated it cannot rule out that the model has reached the "critical" cybersecurity capability threshold. Additionally, the company clarified in the post that the Astra model was not involved in the recent Hugging Face security incident, and is continuing benchmark tests under the Preparedness Framework to manage frontier cybersecurity capabilities. As a result, OpenAI has suspended internal activities related to Astra that do not yet meet these enhanced security control requirements. The "critical" capability is defined as: a model can, without human intervention, discover and exploit all severe functional zero-day vulnerabilities across a large number of real, hardened critical systems; or independently design and execute end-to-end novel cyberattack strategies against hardened targets based solely on high-level objectives. Prior models, such as GPT-5.6-Sol, were only rated at the "high" level.