Story perspectives

OpenAI’s Astra Tops Critical Cyber Threshold, Finds Zero-Days

9/2/2026

Summary

Story summary

OpenAI announced Astra is the first to exceed its “Critical” cybersecurity capability threshold.
Astra can independently discover and exploit unknown software vulnerabilities without step-by-step human guidance.
In ExploitBench tests, Astra outperformed GPT-5.6 Sol, found two zero-days and refused 91.5% of malicious requests versus 59%.
OpenAI paused Astra’s training for weeks after the July Hugging Face cyberattack.
OpenAI will monitor Astra with testers and later expand Daybreak Blue access after calibration.

History

Historical Context

In 2010, the Stuxnet worm—crafted by the United States and Israel—infected Iranian nuclear facilities, marking the first autonomous cyber weapon and reshaping control-system security. Stuxnet spread to roughly 100,000 computers worldwide, sabotaged about 1,000 centrifuges, and evaded detection through four zero-day exploits, prompting global alarm. OpenAI’s Astra now autonomously discovers zero-day flaws, refusing 91.5% of malicious prompts, echoing Stuxnet’s self-directed exploitation and raising alarm among security teams. The precedent set by Stuxnet warns regulators and firms like Microsoft, Google, and the European Commission to craft tighter AI-cybersecurity policies.

1 of 2

Story summary

OpenAI announced Astra is the first to exceed its “Critical” cybersecurity capability threshold.
Astra can independently discover and exploit unknown software vulnerabilities without step-by-step human guidance.
In ExploitBench tests, Astra outperformed GPT-5.6 Sol, found two zero-days and refused 91.5% of malicious requests versus 59%.
OpenAI paused Astra’s training for weeks after the July Hugging Face cyberattack.
OpenAI will monitor Astra with testers and later expand Daybreak Blue access after calibration.

1 / 2