OpenAI is slowing parts of the development of its upcoming Astra AI model after early testing raised concerns that the system could have exceptionally powerful cybersecurity capabilities.

OpenAI says early testing indicates Astra may be capable enough to reach the “Critical” cybersecurity threshold outlined in its Preparedness Framework. As a precaution, the company has tightened safeguards around the model and paused internal Astra-related work that does not meet the new security requirements.

That does not mean Astra has been confirmed as a Critical-risk model, nor does it mean the AI has carried out a real-world cyberattack. Instead, OpenAI is treating the early results as serious enough to warrant stronger precautions while testing continues.

The move offers a clear glimpse at one of the biggest challenges facing developers of frontier AI: the same capabilities that could help security teams find dangerous vulnerabilities could also make sophisticated cyberattacks easier to carry out.

Why OpenAI Is Concerned About Astra

Astra appears to represent a significant jump in both agentic coding and cybersecurity performance.

OpenAI said its latest internal evaluations, combined with assessments from outside experts, showed enough progress that the company could no longer rule out its highest cybersecurity capability classification.

Under OpenAI’s Preparedness Framework, the Critical threshold goes well beyond an AI simply being good at writing code or explaining security concepts.

A model at that level could potentially identify and develop working zero-day exploits against hardened real-world systems without human intervention. It could also devise and execute sophisticated attacks against heavily protected targets based largely on a high-level objective.

That distinction matters. OpenAI is not saying Astra has definitely crossed that line. The company says testing is still underway, but the early performance is strong enough that it is acting as though the higher risk may be possible.

OpenAI Is Tightening Security Around Astra

Rather than continuing development under normal conditions, OpenAI has introduced a series of additional controls around the model.

Astra-related work is being moved into more isolated testing environments with restricted network and tool access. OpenAI is also strengthening protection around model weights, adding encryption and monitoring capabilities, and using sandboxed execution for higher-risk activities.

The company has also introduced monitoring across Astra’s agentic applications during training and evaluation, with systems designed to flag potentially risky actions and trigger further security review.

OpenAI said internal activities involving Astra that do not yet satisfy those tougher requirements have been paused. The company also plans to work with government agencies and selected AI safety organizations on further testing.

Reuters reported that the measures were triggered after preliminary evaluations indicated Astra could perform increasingly sophisticated cyber tasks autonomously.

What “Critical” Cyber Capability Actually Means

OpenAI’s terminology can sound more alarming than it is without context.

Under the company’s current Preparedness Framework, “Critical” is a capability threshold rather than a declaration that a model is inherently dangerous.

OpenAI divides some frontier capabilities into High et Critical categories. High-capability systems require safeguards before deployment. Systems reaching the Critical level face additional safeguards during development because they could introduce new paths to severe harm.

In cybersecurity, that means the concern is not simply whether an AI can help someone write malware or find an ordinary software bug. The higher threshold focuses on far more advanced abilities, including autonomous exploitation of serious previously unknown vulnerabilities and complex attacks against hardened systems.

For Astra, OpenAI says that determination has not yet been finalized.

More Autonomous AI Creates a Bigger Security Challenge

The issue also reflects how quickly modern AI systems are changing.

Traditional chatbots mostly responded to individual prompts. Newer agent-based AI systems can reason through multi-step objectives, analyze large codebases, use software tools and take actions with less direct human involvement.

That makes them potentially much more useful. An advanced AI security agent could examine thousands of lines of code, identify weaknesses and help developers patch vulnerabilities far faster than a human team working alone.

But those same capabilities are inherently dual-use.

A system capable of finding vulnerabilities for defenders could potentially help attackers find them as well. An AI that can automate legitimate penetration testing may also lower the technical barrier to conducting more sophisticated attacks.

That is why cybersecurity has become one of the key areas covered by OpenAI’s Preparedness Framework.

OpenAI Is Also Giving Cyber Defenders More Powerful AI

Interestingly, OpenAI is not responding to stronger cybersecurity capabilities simply by locking them away.

On August 10, just days after revealing its concerns about Astra, the company announced an expansion of its Daybreak cybersecurity program and introduced GPT-5.6-Cyber for approved security professionals.

The strategy is essentially two-sided: apply tighter controls to the most capable models while giving vetted defenders access to advanced AI tools that can help identify and fix vulnerabilities.

OpenAI said GPT-5.6-Cyber remains at the High, rather than Critical, cybersecurity capability level under its Preparedness Framework. Access to its more sensitive capabilities is also restricted through identity verification, monitoring and approved-use requirements.

OpenAI already applies additional automated safeguards to some cybersecurity requests made through ChatGPT, Codex and its API, particularly when a request could cross from legitimate defensive research into harmful activity.

What Astra Means for the Future of Frontier AI

Astra may prove to be an important test of whether voluntary AI safety frameworks can keep pace with rapidly improving model capabilities.

For years, most competition between AI companies centered on intelligence, benchmark performance, speed and cost. Frontier models are now becoming capable enough that security during development is becoming just as important as security after release.

OpenAI’s response to Astra suggests that advanced AI development may increasingly involve controlled environments, restricted network access, continuous monitoring and external safety evaluations long before a model reaches ordinary users.

There is also a difficult balance to strike.

Making powerful cybersecurity AI available to trusted defenders could help companies discover flaws before criminals exploit them. But as those capabilities improve, ensuring the same technology cannot easily be redirected toward offensive operations becomes increasingly important.