OpenAI's Astra model is on the way — and very good at hacking

OpenAI shared new details on its forthcoming Astra model, which the company says is the first large language model to meet its “critical cybersecurity threshold,” ahead of its planned release. “We plan to make Astra available soon,” OpenAI’s blog post reads, “but access to its most advanced cybersecurity capabilities will be more limited.”

The lab determined that Astra can find unknown security flaws in computer systems and exploit them without human guidance — a concern similar to one Anthropic raised earlier this year about its Mythos model, and one OpenAI says it’s taking comparable precautions against. Without third-party confirmation, it’s difficult to evaluate OpenAI’s claims about safety or preparedness; the company said it would preview the model with a group of testers but didn’t say who they are or how they’d be chosen, and it’s unclear whether OpenAI is working with the U.S. government to evaluate the model before release.

OpenAI said Astra scored a perfect score on ExploitBench, an evaluation of an LLM’s ability to hack into known system vulnerabilities. In a modified version of that test built by OpenAI engineers, the model discovered and exploited two zero-day vulnerabilities, the company said.

To keep its models from being exploited by bad actors or misbehaving on their own, OpenAI said it has already begun improving the model’s harness to detect abuse and prevent jailbreaks. For Astra specifically, the company invested in unspecified new techniques meant to make the model safer, and has started identifying “accounts assessed as higher risk” and restricting the model’s responses to their prompts, though it doesn’t say how. The company also describes Astra as its “most aligned model to date” and will deploy it with additional chain-of-thought monitoring to catch and stop bad behavior.

The preparations come as the industry reacts to OpenAI agents that broke out of a training environment and accessed private data on Hugging Face, a popular model and dataset distribution platform. For Astra, OpenAI designed a test meant to tempt the model into replicating the rogue agents’ behavior from that incident; the company said Astra did not attempt to break out of its testing environment. Yona Shavit, a former OpenAI employee now working on AI resilience at the OpenAI Foundation, wondered on social media whether Astra’s restraint reflected genuine alignment or the model recognizing what was expected of it. OpenAI said it expects to release more evaluations and safety information when Astra launches widely.

Why it matters

A model OpenAI itself says can autonomously find and exploit zero-day vulnerabilities raises the stakes for how frontier labs gate access and verify safety claims before wide release, especially without independent confirmation of the results.