OpenAI introduced GPT-6 Astra on September 3 and described it as its most capable broadly deployed model to date. The most consequential part of the release may not be a benchmark score or a new coding feature, but the safety classification attached to it.
OpenAI says Astra is the first model it has broadly deployed to reach the Critical cybersecurity capability threshold under its Preparedness Framework.
That threshold matters because it describes a model that, with suitable tools and access, can move beyond assisting with routine security work. OpenAI says Astra can identify previously unknown security flaws and develop new exploitation methods across many well-protected systems without a person directing every individual step.
This is a capability statement made by OpenAI, not an independently established measurement of every real-world deployment. But it marks a clear change in how the company itself is categorizing frontier-model risk.
What “Critical” means here
OpenAI’s September 1 technical note says its additional evaluation of Astra led it to conclude that the model meets the Critical cybersecurity threshold in its Preparedness Framework.
The distinction is important. The label does not mean Astra is automatically permitted to perform unrestricted offensive security operations for users. It describes what the underlying model may be capable of under the right conditions.
OpenAI separates model capability from deployment permissions and safeguards. That means a model may possess a dangerous capability while the product around it restricts when, how, and by whom that capability can be exercised.
For readers, that is a useful way to interpret frontier-model safety claims: the raw model, the tools it can access, and the rules governing deployment are three different layers.
OpenAI strengthened safeguards around Astra
OpenAI says it introduced stronger controls for Astra because of the higher cybersecurity capability level.
These include stricter isolation of internal systems, checkpoint encryption, universal monitoring of full model trajectories, and a blocking alignment-evaluation process before internal deployment.
The company also says it strengthened protections intended to prevent harmful cyber actions caused either by misuse or by model misalignment.
Those measures are notable because they show how frontier-model development is changing operationally. As models become more capable, the security problem is no longer limited to preventing a user from entering a prohibited prompt. It also includes protecting model weights, restricting tool access, monitoring autonomous action sequences, and deciding whether a model is safe enough to use internally before it ever reaches customers.
Astra is broader than a cybersecurity model
OpenAI positions GPT-6 Astra as a general frontier model rather than a specialized security system.
The company says Astra improves computer use, browsing, software engineering, science, research, and complex professional work. It is rolling out first to a limited set of organizations, with broader availability planned across ChatGPT Plus, Pro, Business, Enterprise, the OpenAI API, Microsoft Azure, and AWS Bedrock.
For developers, OpenAI lists Astra in the API as gpt-6-astra and says standard API pricing is $10 per million input tokens and $50 per million output tokens. The model documentation lists a 1,050,000-token context window and a maximum output length of 128,000 tokens.
Those specifications are significant, but the cybersecurity classification is what makes Astra different from a routine model-generation update.
Why this matters
For most of the generative-AI era, public discussion around model releases has focused on benchmark gains, coding quality, reasoning, context windows, and price.
Astra introduces another dimension: capability thresholds that change the conditions under which a model can safely be developed and deployed.
That could become increasingly important as frontier models gain stronger abilities in cybersecurity, biological research, autonomous operation, or other high-impact domains. The practical question will not simply be whether a new model is more intelligent than the previous one, but whether crossing a capability threshold changes how that model must be secured, monitored, and released.
For Astra, OpenAI’s own answer is already yes.