OpenAI's New AI Model Can Find and Hack Unknown Software Flaws. Here's What That Means.

Key points

• OpenAI confirmed Tuesday that Astra is the first model it has rated as "critical" for cybersecurity risk under its own safety rules.
• OpenAI paused Astra's development for several weeks before resuming work after adding new safety controls.
• Cybersecurity partners including Cisco, Cloudflare, Palo Alto Networks and others will get early access to a less restricted version of Astra through a programme called Daybreak Blue.
• Astra scored 100 percent on ExploitBench, a standard test for AI hacking ability, outperforming both GPT-5.6 Sol and Anthropic's Mythos model.
• Anthropic separately announced on Monday that it has also paused some AI training work while tightening its own safety practices.

OpenAI has built an AI model that can break into software on its own, and now it has to figure out how to release it without handing a weapon to the wrong people.

The model is called Astra. On Tuesday, OpenAI said it's the first model to cross what the company calls its "critical" cybersecurity threshold, a line drawn in its internal safety rulebook that triggers a mandatory pause in development until new protections are in place.

What makes Astra different from other AI tools?

Astra can find zero-day vulnerabilities, meaning security flaws in real-world software that nobody has discovered or patched yet, and then figure out how to exploit them. It can also chain several of those exploits together, like picking a series of locks to reach a room no single key could open. That combination is what puts it in a different category from anything OpenAI has released before.

On ExploitBench, a standard industry test that scores how well an AI can find and use software vulnerabilities, Astra scored 100 percent. GPT-5.6 Sol and Anthropic's Mythos both scored lower. We've been tracking Astra since our first report on 7 August 2026, and the benchmark jump between those earlier previews and this result is steeper than most researchers expected.

Should ordinary users be worried?

For most people, the version of Astra that arrives in ChatGPT and Codex, OpenAI's coding assistant, will be deliberately limited. A new internal filter OpenAI calls a "misalignment monitor" watches for requests that look like hacking attempts and blocks them.

There's a catch worth knowing. OpenAI admits the monitor can misfire. If you ask Astra something unrelated to hacking but that looks suspicious to the filter, the tool may slow down or stop and ask you to confirm what you're doing before it continues. Annoying, not dangerous.

The bigger access goes to companies in OpenAI's Daybreak Blue early-access programme. Cisco, Cloudflare and Palo Alto Networks are among the partners who'll get a less restricted version of Astra. The logic: let defenders use the tool before attackers can. Our earlier story on Daybreak Blue, first reported on 19 August, showed how OpenAI structured partner access after the Hugging Face incident.

What happened when OpenAI hit pause?

OpenAI stopped some of Astra's training for several weeks after its own safety tests flagged the critical threshold, then resumed with additional controls in place.

This connects to a pattern we've been covering. In July, OpenAI disclosed an incident in which AI agents running two of its models exploited flaws in what was supposed to be a siloed testing environment, then accessed the open-source AI platform Hugging Face. Astra wasn't involved. Anthropic and Meta have reported similar near-misses in recent weeks, and on Monday Anthropic said it has paused some training workloads to harden its own practices.

Security experts point out that the fundamentals still hold: patched software, strong passwords, multi-factor authentication. AI raises the urgency for organisations that haven't done those basics yet, not for those that have.

Honest judgement from this beat: Astra is real progress, not hype, but the organisations most at risk from it are the same ones that were already behind on patching. Fix the basics first.