OpenAI gates a 100% ExploitBench model behind refusals it plans to loosen in weeks
Astra scored a perfect 100% on OpenAI's own exploit-development benchmark, against 78.5% for GPT-5.6 Sol, and the shipped model's refusal to write proof-of-concept code is a policy the company has already said it will relax.
The Watch · Security desk
What happened
- OpenAI unveiled GPT-6 Astra on Thursday, days after saying the model had reached the Critical cybersecurity capability threshold under the company's Preparedness Framework.
- OpenAI reported a perfect 100% for Astra on ExploitBench, which measures turning known vulnerabilities into working exploits, up from 78.5% for its predecessor GPT-5.6 Sol.
- OpenAI says that if run without safeguards, Astra can use previously unknown vulnerabilities for code execution in hardened browsers and build privilege-escalation exploits for hardened operating systems.
- The version being released is confined to secure code review and patching, and refuses prompts that ask it to write proof-of-concept exploit code.
- Rollout starts with a small set of organizations and is expected to widen to ChatGPT Plus, Pro, Business and Enterprise users plus the OpenAI API, Microsoft Azure and AWS Bedrock.
Why it matters
- Who has to decide decision Remediation windows sized on the belief that public exploit code trails an advisory by days now have to be justified rather than inherited, and asset owners choose between shortening SLAs and betting the old tempo holds.
- What's now possible capability Subsidized frontier access at $1 billion, plus the MS-ISAC pilot, puts exploit validation within reach of water utilities and county IT shops that cannot hire the skill at any price they can pay.
- Who's exposed exposure Because the restraint is applied to requests rather than absent from the weights, who is exposed now turns on jailbreak resistance, and OpenAI publishes no success rate for it.
- What doesn't add up contradiction OpenAI presents Astra as its most aligned model while reporting it crossed a Critical cyber threshold, and concedes its own guardrails sometimes stop legitimate defensive work, so the same gate taxes the defenders it is meant to arm.
Next story · Build · Sep 10
Astra's Critical cyber rating ships a real-time pause switch inside the Bedrock service boundaryConfirmed17 publishers
Read the two ExploitBench numbers as failure rates. GPT-5.6 Sol missed 21.5% of the tasks, about one in five. Astra missed none [14]. The benchmark scores the step between an advisory and working code, turning known software flaws into exploits [2], so what matters to a patch queue is less the score than what the score was measured against.
The announcement does not say. Task count, target software, an evaluation run by anyone other than OpenAI, a jailbreak success rate, any observed misuse: none of it appears, and every capability figure is the company's own reporting [11].
The zero-day claims sit apart from the benchmark. OpenAI says Astra reaches substantially higher arbitrary code-execution rates than Sol against flaws it dates as the previous three months, July to August 2026, and that the set included two zero-days in software it does not name [4]. July to August is two months [15]. Small, but it is the only description offered of how fresh the tested bugs were.
The brake is server-side, and it has a date on it. OpenAI says less restrictive safeguards arrive through Daybreak in the coming weeks, opening up vulnerability and proof-of-concept validation, malware analysis, and detection engineering [7]. The company frames the whole release around what it calls a defender's window, a narrowing opportunity to close gaps before attackers seize them [17]. It also says it strengthened the model against jailbreaks, gave its monitoring systems more context, and added safeguards to detect and contain misalignment [8].
For the rest of the stack, the numbers that travel are FrontierMath Tier 4 at 98% and ARC-AGI-3 at 99.9% [18]. Those are the ones a procurement deck will quote. ExploitBench is the one a vulnerability manager should read, because a perfect score on advisory-to-exploit conversion is a statement about tempo, and tempo is what remediation SLAs are actually built on.
On OpenAI's own account the weights crossed the Critical cybersecurity threshold in its Preparedness Framework before the model shipped [1]. The restraint that came with them is configuration, applied per request, and scheduled by the vendor to relax. Anyone whose patch windows assume public exploit code trails an advisory by days should test that assumption against the tier OpenAI has promised for the coming weeks rather than the one available on launch day.
What to watch
- Whether Daybreak's looser tier is gated to vetted defenders or opens to all API customers, and what verification is required.
- A third-party run of ExploitBench against Astra, or publication of the task set, which would let buyers size the 100% against their own backlog.
- Whether Azure and AWS Bedrock deployments enforce the same proof-of-concept refusals as OpenAI's own API.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption20
- Hype gap+45
- Incentives70
- Confidence55
Perspective Coverage
4 publishers- Builder
- Builder 30%
- Operator
- Operator 42%
- Investor
- Investor 28%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Days before the launch, OpenAI said GPT-6 Astra had reached the "Critical" cybersecurity capability threshold under its Preparedness Framework.
- [2]
OpenAI said Astra saturates ExploitBench with a 100% score; ExploitBench evaluates a model's ability to turn known software vulnerabilities into working exploits.
- [3]
GPT-5.6 Sol, OpenAI's previous frontier cyber-capable model, scored 78.5% on ExploitBench, against Astra's 100%.
- [4]
OpenAI said Astra achieves substantially higher arbitrary code-execution rates than GPT-5.6 Sol when tested on flaws from "the previous three months between July and August 2026," a set that included two zero-day vulnerabilities in unspecified software.
- [5]
OpenAI said Astra is equipped to use previously unknown vulnerabilities to achieve code execution in hardened browsers and to develop privilege-escalation exploits for hardened operating systems, if allowed to run without any safeguards.
- [6]
OpenAI said the version of Astra being released is limited to secure code review and patching and refuses to comply with prompts related to creating proof-of-concept exploits for vulnerabilities.
- [7]
OpenAI said that through OpenAI Daybreak it plans to expand access and roll out less restrictive safeguards in the coming weeks, enabling more defensive workflows including vulnerability and proof-of-concept validation, malware analysis, and detection engineering.
- [8]
OpenAI said it included stronger model robustness against jailbreaks, more context for its monitoring systems, and extra safeguards to help detect and contain misalignment.
- [9]
OpenAI on Thursday officially unveiled GPT-6 Astra, describing it as the "world's most intelligent and aligned model."
- [10]
OpenAI warned that Astra's safety checks can sometimes interrupt legitimate work, including defensive cybersecurity, at which point the user is prompted to review the action before continuing.
- [11]
The Hacker News report attributes all of Astra's benchmark and capability figures to OpenAI's own statements, and contains no independent evaluation, no ExploitBench task set or task count, no jailbreak success rate and no account of misuse in the wild.
- [12]
Daybreak for Frontline Defenders commits $1 billion to subsidized model access, hands-on training and technical assistance for critical infrastructure sectors including water systems, electricity providers, state and local governments, banks, non-profits, open-source maintainers and organizations with limited security resources.
- [13]
OpenAI announced a pilot with the U.S. Multi-State Information Sharing and Analysis Center (MS-ISAC) to equip an initial group of public sector and water system defenders with Daybreak access, guided training and hands-on assistance.
- [14]
Measured as failures rather than scores, GPT-5.6 Sol failed 21.5% of ExploitBench tasks, roughly one in five, while Astra failed none.
- [15]
The window OpenAI gave for the tested flaws, July to August 2026, spans two calendar months, while the same sentence describes it as the previous three months.
- [16]
Astra is rolling out to a small set of organizations and is expected to become available to all ChatGPT Plus, Pro, Business and Enterprise users, as well as through the OpenAI API, Microsoft Azure and AWS Bedrock.
- [17]
OpenAI said defenders have "a narrowing opportunity to use AI to close security gaps before attackers seize them," which it called a defender's window.
- [18]
OpenAI reported that Astra saturates FrontierMath Tier 4 with a 98% score and ARC-AGI-3 with a 99.9% score.
Sources
4 independent publishers whose own reporting we read for this story.
- blockchain.newsOpenAI: GPT-6 Astra Saturates ARC-AGI-3 | Flash News Detail | Blockchain.News
1 article · September 3, 2026
- securityaffairs.comOpenAI Astra Brings Autonomous Zero-Day Exploitation to AI
1 article · September 2, 2026
- securityweek.comOpenAI’s Astra Becomes First Model to Cross Critical Cybersecurity Threshold
2 articles · September 2, 2026
- thehackernews.comGPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests
2 articles · September 4, 2026
Topics and entities
Topics
- AI Benchmarks
- Zero-Day Vulnerabilities
- Frontier AI safety frameworks
- AI cyber capabilities