OpenAI Astra launches with critical cybersecurity capability

OpenAI has launched OpenAI Astra, a new model aimed at computer use, software engineering, cybersecurity and other professional work. The company says it is its most capable model yet, while president Greg Brockman says users can decide whether its arrival qualifies as artificial general intelligence.

OpenAI Astra is built for agents and cybersecurity

OpenAI says Astra can handle multistep agentic tasks, build websites and create documents, spreadsheets and presentations. The company also calls it its best model for software engineering, with stronger performance on complex tasks in real codebases, according to The Verge’s report.

Cybersecurity is the more tightly controlled part of the launch. In its official Astra safety assessment, OpenAI says the model meets its Critical cybersecurity capability threshold — the first model it has designated at that level. The company says Astra found two previously unknown vulnerabilities during an internal evaluation and achieved a 100% score on ExploitBench, although those results reflect controlled testing and not the default production configuration.

OpenAI also reports a 91.5% refusal rate on its cyber-jailbreak evaluations, compared with 59% for GPT-5.6 Sol. Advanced cybersecurity access will initially be limited to alpha testers, with wider defensive access planned through Daybreak Blue.

The AGI question is still being left to the reader

OpenAI’s announcement arrives after the company delayed parts of Astra’s training and release to strengthen monitoring and security controls. That follows the Hugging Face incident involving an earlier model, which OpenAI says was not Astra. The company says Astra has stronger protections against harmful cyber requests and unauthorised actions, including production monitoring that can pause or stop a task.

Brockman said there is no longer a contractual AGI trigger tied to Microsoft, but added: “For me personally, I do think we’re there.” OpenAI’s chief scientist Jakub Pachocki has also warned that monitoring becomes harder as models become more capable. The model may be powerful; the audit trail is the part still under construction.

OpenAI says Astra will roll out first to Daybreak cybersecurity customers, followed over the next week by paid Plus, Pro, Business and Enterprise accounts. API and AWS access are also planned. No UAE pricing or local availability has been announced, so UAE developers and security teams will need to wait for access terms rather than assume that a global API launch means immediate regional availability. OpenAI’s earlier security-focused model was also limited to vetted teams, while the Hugging Face incident exposed the monitoring problem Astra is designed to address.