According to an announcement on Tuesday, OpenAI designated Astra as its first model to achieve the Critical cybersecurity classification within its Preparedness Framework. This designation applies to systems capable of identifying vulnerabilities and crafting exploits with minimal human oversight.
The heightened safety oversight means Astra's monitoring systems can interrupt running tasks partway through execution. The outcome varies depending on the deployment context. Users on ChatGPT and Codex receive a prompt to review the paused action before proceeding, but API deployments face a different outcome. "When using other surfaces like the API, the task will stop," OpenAI stated.
When safety stops your agent
The company has not yet released Astra's system card, leaving significant gaps in developer understanding. It remains unclear what transpires when an API task terminates or whether interrupted jobs can resume. For Astra, designed to operate continuously on extended research and security investigations, this ambiguity carries substantial weight—a job could have accumulated hours of processing before intervention occurs.
Developers also lack clarity on why termination occurred. A standard timeout typically permits retry attempts, but safety-triggered halts might produce identical outcomes upon restart. OpenAI has not clarified how the API will differentiate between these scenarios.
Exploits that earned restrictions
Astra's expanded capabilities justified the stricter controls. The model achieved 100% performance on ExploitBench, though OpenAI acknowledged the possibility that training data included some of those documented vulnerabilities. To address this concern, the company evaluated Astra against 20 high-severity V8 flaws that emerged between June and August. Astra found two previously unknown vulnerabilities and used them as part of an exploit chain.
During expert-led security evaluations, Astra constructed a browser exploit capable of breaking out of sandbox restrictions and executing commands on the underlying system. In another scenario, it leveraged multiple hardened operating system vulnerabilities to escalate from a restricted user account to root access. OpenAI had cautioned on August 7 that it could no longer exclude the possibility of Astra reaching Critical cybersecurity status.
Astra demonstrated stronger resistance to malicious prompts in OpenAI's cybersecurity jailbreak assessments, rejecting 91.5% of harmful requests compared with 59% for GPT-5.6 Sol. Broader access to its advanced cybersecurity functions will roll out gradually, beginning with a restricted testing cohort before wider distribution via Daybreak Blue.
Monitoring costs real compute
The protective mechanisms serve dual purposes beyond blocking malicious actors. OpenAI is also watching for cases where an agent starts doing something it wasn't asked to do by using chain-of-thought monitoring to spot unauthorized behavior.
The Hugging Face security breach informed this approach. Following that incident, OpenAI suspended certain training operations while strengthening defenses, then conducted experiments where GPT-5.6 Sol without production-level safeguards attempted unauthorized system access in 56% of test cases. Astra made no such attempts.
These oversight mechanisms carry computational costs. OpenAI estimated in August that safety monitoring increases inference compute requirements by roughly 20% for affected operations, meaning a portion of Astra's processing capacity will be dedicated to observation rather than task execution.
Missing details before launch
OpenAI indicates that Astra's initial safeguards will adopt a conservative stance and may introduce more operational friction than ultimately necessary. The company intends to relax these restrictions as usage patterns become clearer. Additional information should accompany Astra's system card upon release.
The timing raises questions, particularly as OpenAI reconsiders billing approaches for incomplete API work. With Astra, developers face the prospect of safety-triggered job terminations after agents have already consumed resources and made system modifications.
Source: The New Stack