OpenAI grades its own unreleased Astra model Critical for autonomous zero-day discovery

OpenAI is both the grader and the graded here. OpenAI published the Preparedness Framework in December 2023 ^[3], and OpenAI decided, in a September 1 post titled "Path to Astra," that its own forthcoming model will complete the full chain of a novel attack or a zero-day with minimal human intervention ^[2]. The evidence is also OpenAI's, being a 100% score on ExploitBench, which tests exploitation of bugs already known ^[4], plus an internal run against 20 high-severity V8 flaws that had only recently become public, from which the model produced two zero-days while spending fewer tokens than Sol ^[5]. Two out of twenty is ten percent ^[18], and it was measured on a set the vendor curated, made up of defects someone had already found.

The quantified part of the disclosure is an efficiency result. The alarming part is qualitative: chaining unknown browser bugs into a sandbox escape, and climbing from ordinary user to root, both done in expert-led trials ^[8]. Expert-led means humans in the loop, and that sits in tension with minimal intervention ^[2]. OpenAI's own reassurance is likewise a negative: the model was not involved in the Hugging Face incident and did not try to leave its sandbox when a scenario was built to tempt it ^[6].

The one line item anyone paid for is the training pause. OpenAI committed on August 18 to stop reinforcement-learning training on deployment-bound models for two weeks so engineers could reinforce research clusters and improve monitoring, and resumed on August 28 ^[10], which is ten days, four short of fourteen ^[19]. Ten days of frontier cluster time redirected from capability to instrumentation is a real allocation choice, and the four-day gap between the promise and the calendar is the sort of bookkeeping detail that tells you which of the two the schedule actually served.

Then the distribution question, which is where the money sits. Cryptopolitan's account of the post says both that everyone will have access to Astra's most advanced functions and that those capabilities are reserved for organizations in OpenAI's Daybreak coalition, with Daybreak Blue firms getting the sharpest defensive features ^[7]; one of those is wrong, and the difference decides whether a security team buys a product or applies for a membership. OpenAI also says it will monitor and throttle answers to accounts it judges higher-risk ^[12], and that is rate-limiting functioning as a control surface, not a licence term.

My view, and it is probably wrong in the direction of cynicism: declaring your unshipped model Critical is the cheapest possible justification for a gated tier, since the gate needs the grade to look necessary, and the grade needs no auditor. The counter-thesis is straightforward and might well be right, that Pachocki's factor-of-two claim about computation-graph depth relative to GPT-4 ^[15] is exactly the sort of boring architectural detail a lab would not bother inventing, and that his stated worry about a race into unmonitorability kicked off by confused reporting ^[14] is a real thing to worry about. What would settle it is someone outside OpenAI reproducing the twenty-flaw result.