OpenAI's next model can find and exploit unknown flaws by itself
On 1st Sept'26, OpenAI said its forthcoming model, Astra, is the first it has ever classified as "Critical" for cybersecurity under its Preparedness Framework. That threshold means a model can find and build working zero-day exploits in hardened real-world systems, or run an end-to-end attack on a hardened target from a single high-level instruction, without a person guiding each step. Astra scored a perfect result on ExploitBench, a benchmark for turning known vulnerabilities into working exploits; in a modified version of the test it found and chained two previously unknown flaws, which OpenAI says it is now disclosing to maintainers. Every previous OpenAI model, GPT-5.6-Sol included, was rated High. A broadly available version is coming "soon", with the strongest cyber capabilities held back for a small vetted group. OpenAI also warned its new safeguards will sometimes flag legitimate work as misuse, pausing tasks in ChatGPT and Codex, and stopping them outright through the API.
What it actually means
This is a frontier lab that has looked at one of its own capabilities and decided it is too dangerous to sell in full.
Read that from where you sit. The rationing only binds the people who buy from OpenAI. Whoever you're defending against isn't in that queue, and a capability doesn't stop existing because the shop won't sell it. The asymmetry runs the wrong way: offence arrives on its own schedule, defence arrives on a waiting list.
So the practical consequence is unglamorous. Your security posture was priced for a world where finding an unknown flaw in a hardened system took a skilled human weeks. That assumption is now on a clock and nobody will tell you when it expires. Patch what you already know about. Retire the systems you've been meaning to retire. Stop treating "nobody has found it yet" as a control.
And the second-order one most people will skip past: OpenAI has said out loud that its safeguards will misfire on legitimate work, and that through the API the task simply stops. If you run long agent jobs, build for that now. A pipeline that assumes the model always finishes is a pipeline with an unhandled failure mode.
A frontier lab just decided one of its own capabilities is too dangerous to sell in full. Your attacker isn't in that queue.
2unknown flaws Astra found and chained on its own
Source: Axios (Ina Fried) · Thursday 3 September 2026