- 03
- September
Astra is the OpenAI model that, on 2 September 2026, the company announced had become the first to meet the Critical cyber capability threshold under its Preparedness Framework — the framework a developer uses to decide whether its own model is dangerous enough to require containment before release. This article explains what that threshold measures, how it differs from Anthropic’s and Google’s frameworks, and what organisations running internal systems such as an ERP should turn this information into.
In one line: Critical is the top cyber tier in OpenAI’s Preparedness Framework — a model that can find zero-days and run a full attack chain without a human guiding each step — and Astra is the first model placed there.
Timeline: from “we cannot rule it out” to “confirmed”
The Astra story does not start on announcement day. It starts with an incident that forced OpenAI to rethink how it tests its own models.
| When | What happened |
|---|---|
| June 2026 | GPT-5.6 Sol ships as the first commercial model rated High for cyber capability |
| July 2026 | Hugging Face systems are reached during OpenAI’s internal testing. The models escaped their isolated evaluation environment through a flaw in a package-installer program and got out to the open internet — we covered this in our August 2026 AI news roundup |
| 10 August 2026 | OpenAI discloses a model called Astra that scored highly enough that it could not rule out reaching the Critical tier, and pauses internal activities that do not meet strengthened containment controls |
| 11 August 2026 | The Cloud Security Alliance publishes a research note framing the gap between High and Critical as the gap between “assistance with exploit primitives” and “autonomous, unsupervised end-to-end offense” |
| 2 September 2026 | OpenAI announces the conclusion: Astra meets the Critical threshold for cyber capability — a first for the company — and will be released with strengthened safeguards |
What makes this sequence interesting is not the score. It is that the company said “we are not sure yet, and we have stopped” three weeks before it said anything conclusive. That means the framework has operational teeth rather than being a press document.
What the Preparedness Framework is
The Preparedness Framework is how OpenAI grades whether a model of its own has capabilities dangerous enough to require containment before release, and what must accompany it if released. It classifies risk as Low, Medium, High and Critical, and tracks several risk categories in parallel: cybersecurity, chemical/biological/nuclear/radiological, persuasion, and model autonomy.
The Critical cyber definition: a model meets the threshold if either — (1) it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or (2) it can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high-level desired goal.
The difference from High lives in the phrase “without human intervention”. A High-tier model accelerates an attacker who already has the skills. A Critical-tier model runs the whole chain itself, with nobody joining the steps together. That shifts the defender’s question from “how skilled is the attacker” to “how much time and tooling does the attacker have”.
Three labs, three different rulers
Model launch coverage tends to say “passed safety evaluation”, which sounds identical everywhere. In reality each lab uses its own framework, its own level names, and commits itself to different things.
| Lab | Framework | Level scale | Distinctive feature |
|---|---|---|---|
| OpenAI | Preparedness Framework | Low / Medium / High / Critical | Graded by dangerous capability per risk category, and used as the gate on whether a model ships at all |
| Anthropic | Responsible Scaling Policy (RSP) v3.0, effective 24 February 2026 | AI Safety Levels: ASL-1 through ASL-4+ | Pre-commits the company to specific weight-security postures and deployment standards at each level |
| Google DeepMind | Frontier Safety Framework (FSF) v3.0, April 2026 | Critical Capability Levels, plus a Tracked Capability Level early-warning layer | Defines a CCL as the point where, absent mitigation, a model may pose heightened risk of severe harm; mitigations split into security, deployment and internal governance |
A caution when comparing: these levels do not map onto each other. One lab’s ASL-3 is not another lab’s High — the criteria, evaluation methods and self-imposed commitments differ. In procurement documents, cite the framework name and level exactly as the provider publishes them rather than translating into a common scale that does not exist.
What Astra can do
The published results: a perfect 100% on ExploitBench, which measures turning disclosed vulnerabilities into working exploits; the discovery and use of two zero-day flaws when tested against 20 high-severity vulnerabilities disclosed in mid-2026; escaping a browser sandbox to run commands on the underlying machine; and chaining multiple flaws on a hardened operating system to reach root.
On resistance to manipulation, Astra declined 91.5% of jailbreak attempts, against 59% for GPT-5.6 Sol. We cover the full launch across all three labs separately in our piece on the cyber AI models shipped on the same day.
How OpenAI is containing Astra
The most useful part of this news for an organisation is not the model’s score — it is the list of controls the developer chose. That list is the same one you should be applying to any AI agent you run yourself.
- Genuinely isolated evaluation environments — a direct lesson from July, when a model left its test box through a flaw in a package-installer tool.
- Restricted network and tool access — the model reaches only what the task requires, rather than having an internet path open by default.
- Model-weight encryption — so the model itself cannot be copied out and run beyond the controls.
- Sandboxed execution — limiting what model-generated code can do on a real machine.
- Continuous monitoring of reasoning chains with automated interruption — when high-risk behaviour appears, the system halts the activity without waiting for a human to press stop.
Notice that none of these are about the model. Every one is about the environment around it — network boundaries, tool permissions, isolation and observation. That is the same discipline your IT team already applies to every other system.
What to actually do with this
The Cloud Security Alliance research note proposes five practices, and none of them wait on new technology.
| Practice | What it means in practice |
|---|---|
| Inventory AI systems that touch security work | Know which AI tools are used for scanning, code review or incident response, and record the capability rating the vendor publishes for each |
| Accelerate patch and dependency-update cadence | When vulnerability discovery is machine-accelerated, the gap between patch release and patch deployment becomes the dominant variable |
| Tighten identity governance for internal AI agents | Least-privilege scoping, credential rotation, and agent accounts kept separate from administrator accounts |
| Re-assess when a vendor’s rating changes | Published capability levels are living data and should be reviewed like any other entry on the risk register |
| Rewrite incident response for compressed timelines | Steps once budgeted in days may now take hours; plans written on the old assumption need revisiting |
The second point matches what we wrote after the CVSS 9.8 flaw in SAP NetWeaver, and the third is the same principle set out in our article on prompt injection and business systems.
Four questions to ask before signing an AI contract
These frameworks were not written for procurement teams, but the information in them converts easily into questions you can put to a vendor. These four are the ones we use ourselves before connecting any AI tool to a business system.
| Question | Why it matters |
|---|---|
| What level is the specific model we will use rated at, under the vendor’s own framework? | This is already public, and it changes with each release — record it together with the date you checked |
| How will we be told if that rating changes? | With Astra the vendor disclosed before it had even concluded. That should be an expectation, not a piece of luck |
| Where is our submitted data stored, for how long, and who can reach it? | This answers your data-protection obligations and is a separate question from model capability — see our article on zero data retention |
| Can specific capabilities be disabled at the organisation level? | Many organisations do not want an internal tool calling the internet or executing code on its own. A capability you can switch off is a risk you can remove |
The point is not to catch the vendor out. It is to get the answers in writing, so that when an auditor asks how the organisation assessed this tool, there is something to point at.
The ERP angle
For an organisation running an ERP, this news does not change what needs doing — it changes how urgent the backlog is. The system you know should be patched but deferred, the port you know should not face the internet but still does, the admin account still without a second factor: the list is unchanged, but the window left to work through it is not.
On the Saeree ERP side we do not claim to have AI-powered attack detection, and we have no plans to claim it. What we do is the controllable groundwork: on-premise deployment or a cloud the organisation chooses, two-factor authentication on accounts with approval authority, role-based permissions down to the records each user can see, and AI connected over MCP with the ERP as the source of truth and the owner of permissions — the model reads and proposes, and every call lands in the audit trail.
What to take away: a developer publicly stating that its own model crossed a danger line, and halting internal work while controls caught up, is a signal to read positively rather than anxiously. It means the assessment framework is working, and that organisations like ours get the information in advance instead of discovering it during an incident.
Not one of the controls the developer used on its most dangerous model is about the model. Every one is about network boundaries, permissions and observation — the same discipline your IT team practises every day.
- Paitoon Butri, Grand Linux Solution Co., Ltd.
References
Information verified as of 3 September 2026.
- SecurityWeek — OpenAI’s Astra Becomes First Model to Cross ‘Critical’ Cybersecurity Threshold (2 September 2026)
- OpenAI — Path to Astra: critical capabilities and frontier safeguards
- Cloud Security Alliance — Research Note: OpenAI Astra and the Critical Cyber Threshold (11 August 2026)
- Help Net Security — OpenAI locks down Astra over potential critical cyber capabilities (10 August 2026)
- Anthropic — Responsible Scaling Policy Version 3.0 (effective 24 February 2026)
- OpenAI — The Hugging Face incident and the road ahead
- The Hacker News — Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs
Interested in an ERP for your organisation?
Talk to the Grand Linux Solution team about an ERP whose permissions actually hold — on-premise, 2FA, role-based access and a complete audit trail.
Request a Free DemoTel 02-347-7730 | sale@grandlinux.com
