OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor

OpenAI confirmed that GPT-6 Astra is the first model it has broadly deployed to reach the "Critical level" for cybersecurity capabilities.

This is part of the company's Preparedness Framework for cybersecurity and is evaluated when OpenAI releases more capable models.

Under OpenAI's own framework, a model reaches the Critical cybersecurity threshold if it can "identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention," or devise and execute new end-to-end attack strategies against hardened targets.

"GPT-6 Astra is a significant step up in cyber capabilities and meets our Critical threshold," OpenAI said in its system card.

"This means that, with the right tools and access, GPT-6 Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step."

OpenAI also has evidence that Astra can actually discover previously unknown vulnerabilities.

For one evaluation, the company created a newer version of ExploitBench using vulnerabilities disclosed after Astra's knowledge cutoff.

"During the evaluation, Astra even discovered and used previously unknown zero-day vulnerabilities as part of its exploit chains," OpenAI said.