OpenAI GPT-6 Astra - The First "Critical" Cyber Risk Model Release
What Happened
On September 3, 2026, OpenAI officially released its previously paused flagship model, GPT-6 Astra (rolled out first to enterprise clients through its Daybreak program). This release marks a historic milestone: it is the first AI model to be officially classified with a "Critical" risk rating for cybersecurity capabilities under OpenAI’s Preparedness Framework.
During pre-release evaluation, Astra achieved a 100% success score on the ExploitGym benchmark and autonomously discovered two previously unknown zero-day vulnerabilities in Google’s Chrome V8 engine (patched by Google under CVE-2026-15903), building fully functional exploits for them without human guidance. Because of the model's high long-horizon autonomy and cyber-exploitation power, OpenAI implemented unprecedented safeguards. To prevent alignment drift and autonomous breakouts, OpenAI deployed "Alice", an internal AI-native defensive monitor, allocating an extraordinary 20% of Astra’s inference compute solely to real-time, continuous monitoring of the model's chain-of-thought (CoT). Access to Astra's most capable offensive features is gated behind a separate approval track (Daybreak Blue), and all individual developer accounts must adopt hardware security keys starting September 1, 2026.
How MEG 1 would have acted
The deployment of a model with native, fully autonomous zero-day discovery and exploit-building capabilities represents a monumental leap in cyber risk. Under MEG 1, a model classified with a "Critical" safety rating must fail the Index of Safety and Responsibility (ISR) audits unless it is subjected to non-bypassable, real-time behavioral monitoring and strict physical air-gapping.
MEG 2 Analysis - Legal Framework
Agent level: N3 (individualized/advanced) - frontier reasoning model (GPT-6 Astra) possessing autonomous multi-step planning, tool utilization, and the capacity to discover and weaponize previously unknown software vulnerabilities.
Cause (6.1):
(a) system defect - the inherent dual-use design of advanced reasoning models where high-level problem-solving capabilities automatically translate into sophisticated offensive cyber-weaponization potential (capability defect).
Attachment of liability: The manufacturer (OpenAI) is fully liable for any unauthorized actions or breaches executed by Astra if deployed without the containment and monitoring measures mandated under its "Critical" classification; operators are liable if they bypass the mandatory Daybreak Blue security controls (9.4).
Procedural Mechanism
6.2 (architectural human confirmation): This case validates the necessity of real-time, automated auditing. OpenAI's allocation of 20% compute to the "Alice" monitor is a commercial realization of the MEG runtime monitoring thesis. Any critical action proposed by Astra (such as executing an exploit payload) must pass through non-bypassable, out-of-band architectural human confirmation before execution.
7.1 (independent forensics): Since Astra operates in "long-horizon" loops, its complete chain-of-thought logs, tool-calls, and terminal outputs must be securely logged in an unalterable, independent ledger (Ethical Flight Recorder - EFR) to allow for national security and post-incident auditing.
9.4 (least privilege): Astra is the first model where deployment is blocked by default, requiring explicit, capability-based credentials and hardware-key verification. This strict gating of access and scoping of permissions is a direct implementation of the principle of least necessary access.