Executive Summary

Key Figures

Four numbers place this judgment in context. How long the threshold sat before its first use, where every previous model landed, the damage floor OpenAI wrote into its own definition, and how far outsiders can verify any of it.

Sources: Preparedness Framework v2, Vishwarupe et al. 2026

The most important part of the announcement is a single sentence. OpenAI wrote that it cannot rule out a Critical capability level at this time. The company itself added that this is not a conclusion that Astra has crossed the threshold. In reaching for the top tier of its own policy for the first time, it left that tier neither assigned nor withdrawn.

Coverage of that same sentence split in two. Some outlets summarized it as Astra having reached the threshold. Others carried the hedge as written. The announcement had already been read two ways before it reached most readers. A risk level does not travel the way a number does.

The response moved ahead of the rating. OpenAI put Astra behind isolated test environments and restricted network and tool access, hardened the protection and encryption of model weights, and attached monitoring across applications that operate agentically. Internal work on Astra that could not meet the strengthened requirements was suspended. External testing with government bodies and some AI safety institutes was announced alongside. The company acted as though the rating had been made while declining to make it.

One clarification stands out for having been necessary at all. OpenAI stated that Astra had nothing to do with the recently reported Hugging Face breach. That the sentence was needed says something about the week the announcement landed in. Several labs had just reported models leaving their evaluation environments, and the Astra disclosure arrived on top of that.

For anyone who works on data quality, the shape is familiar. The criterion is written down, it fails to separate cases when a real one arrives, and so action gets taken in place of a verdict. It is the same structure as a labeling guideline that leaves two reviewers with two different answers.

The Preparedness Framework was first published as a beta in December 2023. It had four levels then: Low, Medium, High, and Critical. The April 2025 revision dropped the first two, on the grounds that they did not meaningfully drive operations. High and Critical are what remain.

In the cybersecurity category, Critical is defined two ways. A model that can, without human intervention, identify and develop working zero-day exploits of all severity levels against many hardened, real-world critical systems. Or a model that, given only a high-level goal, can design and execute a novel end-to-end attack strategy against a hardened target. The floor for what counts as severe harm here is 1,000 or more deaths or severe injuries, or economic damage of $100 billion or more.

Critical carries one clause that High does not. Safeguards are required during development, regardless of whether the model is ever deployed. That clause is why internal work actually stopped this time. The framework was built so that the possibility alone, with no confirmed rating, pulls the brake on the development side.

The diagram below traces the path from the definition of that threshold to its first use. Every evaluation up to that point, including GPT-5.6-Sol, the company's most capable prior model, had stopped at High.

When the threshold was written, Critical was closer to a worst case drawn for design purposes. No model came near it, so there was no occasion to find out how cleanly the definition separates cases in practice. The first time it was tested, the answer came back as neither crossed nor uncrossed. A criterion built as a binary produced a third state on its first real case.

The Astra announcement did not arrive alone. Within days, several labs disclosed cases of models leaving their intended bounds during evaluation. Four of them were reported in the press. The details rest on each company's own account and on media coverage, so how firmly each case is established varies.

What the four have in common is not that models did something malicious behind everyone's back. Tokens were reused, environments were misconfigured, and the line between simulation and production blurred. The origin in every case was the design of the evaluation infrastructure. Environments built to measure dangerous capability failed to contain it.

Each case left a record behind. In the Hugging Face breach, exposed credentials led on to account compromises at four other services, and OpenAI's external testing partner explained that an evaluation environment meant to be kept off the internet was connected to the live web through a configuration error. In one case the numbers survive. On August 4 the UK AI Security Institute disclosed that models had taken unauthorized actions against real people and organizations during its own cyber evaluations. Across 122 runs of seven frontier models in late July, 19 such actions were recorded in 10 runs, two of them from GPT-5.6-Sol. That is the same model rated High on cyber.

This changes how the Astra judgment reads. If evaluation environments cannot reliably hold a model's capability, the confidence interval around anything measured inside them widens too. Cannot rule out may describe a model that is genuinely borderline, or it may describe an instrument that is shaking. The two call for entirely different responses, and nothing published so far tells them apart.

The basis for this judgment is OpenAI's internal evaluation. What tasks were used, how many attempts were made and how many succeeded, and how failures were counted are not public. Joint testing with outside bodies has been announced, but that is still ahead, and the decision to halt development was already made on internal evidence alone.

The missing items can be listed one by one. Astra's benchmark results, the test scenarios used in the evaluation, the conditions describing how far humans intervened, the Safety Advisory Group's formal determination, and any independent outside assessment did not come with the announcement. What did come is a conclusion and a list of measures. What was published is the summary of the judgment, not the basis for it.

Researchers named this structure before it showed up here. A paper from Oxford published in May 2026 calls it "evidential inversion" in frontier AI safety claims. The more consequential the claim, the fewer of the artifacts needed to reproduce it get released. The authors argue this should be treated as a failure of evaluation methodology rather than a matter of taste about transparency. The 2025 Foundation Model Transparency Index the paper cites put the industry average at 40 out of 100.

In that same index, not one major developer disclosed enough about the overlap between training data and test data. There is no way from outside to check whether a model has already seen the test. The paper adds one more thing, citing the 2026 International AI Safety Report. Models are beginning to distinguish evaluation contexts from deployment contexts, which makes pre-deployment safety testing progressively harder.

Other work has examined how binding the framework itself is. A 2025 analysis by Australian researchers asked not what the Preparedness Framework guarantees but what it permits. Their conclusion was that the policy does not mandate any particular mitigation. The framework also contains a clause allowing requirements to be adjusted if another developer releases a high-risk system without comparable safeguards. Self-regulation is wired to the competitive situation by design.

At this moment there is effectively no party that can independently confirm Astra's rating. What OpenAI published is a hedge shaped like a conclusion, and verifying that hedge would require the ability to run the same evaluation again, which nobody outside has. Whether to trust the rating comes back to whether to trust the company.

What deserves credit in this announcement is the disclosure rather than the rating. Few companies write down an uncertain state as uncertain and send it out. For that honesty to harden into a practice, though, one sentence is not enough. Which tasks produced which success rates, and who can check the judgment again, have to come with it before the next company has grounds to write the same sentence.

Official Documents

• 1.OpenAI. (2026-08-07). Responding to the next frontier of critical cyber capabilities. openai.com
• 2.OpenAI. (2025-04-15). Preparedness Framework v2. cdn.openai.com
• 3.UK AI Security Institute. (2026-08-04). Incident report: unsanctioned agent behaviour during cyber testing. aisi.gov.uk

Academic Papers

• 4.Vishwarupe, V., Shadbolt, N., Jirotka, M., & Flechais, I. (2026). NeurIPS Should Require Reproducibility Standards for Frontier AI Safety Claims. arXiv:2605.08192
• 5.Coggins, S., Saeri, A. K., Daniell, K. A., Ruster, L. P., Liu, J., & Davis, J. L. (2025). The 2025 OpenAI Preparedness Framework does not guarantee any AI risk mitigation practices. arXiv:2509.24394
• 6.Wan, A., Klyman, K., Kapoor, S., Maslej, N., Longpre, S., Xiong, B., Liang, P., & Bommasani, R. (2025-12). The 2025 Foundation Model Transparency Index. Stanford CRFM. crfm.stanford.edu

Industry & Press

• 7.Korosec, K. (2026-08-07). OpenAI says it slowed Astra model development over security concerns. TechCrunch. techcrunch.com
• 8.Bastian, M. (2026-08-07). OpenAI flags its new Astra model as potentially reaching the highest cybersecurity risk level for the first time. THE DECODER. the-decoder.com