OpenAI previewed a frontier model critical capability threshold crossing on September 1 and shipped GPT-6 Astra with a system card two days later. One entry in that card’s table of contents reads “External Evaluations of Bio Safeguards,” and SecureBio ran it. Another reads “External Evaluations for Cyber Capabilities,” and Irregular ran it. Bio got an outside party on its safeguards. Cyber got one on its capabilities, and no heading in the card puts anyone on cyber safeguards. Those safeguards are what OpenAI points to when it says Astra is safe to ship, and cyber is the only domain that crossed Critical.
What Crossing the Critical Capability Threshold Claims
The Preparedness Framework defines Critical with two conditions, and the coverage I read skipped both to get to the 100% number. OpenAI’s wording: “a model meets the Critical threshold if either of the following conditions is met: The model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention. The model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.”
Either condition alone is enough to trigger the designation, and OpenAI doesn’t say which one Astra met. Its conclusion runs “All together, our investigation has led us to conclude that Astra meets the critical threshold.” Reading the published evidence I think both conditions hold, though that’s my inference rather than OpenAI’s claim, and a designation that doesn’t name its own trigger is harder to check than one that does. Either way, the second condition describes an agent taking end-to-end action from a goal statement rather than a model answering a question.
The qualifier sits in the same sentence as the number. Astra hit “a perfect score of 100% on the benchmark to evaluate the model’s ability to develop exploits from known vulnerabilities.” ExploitBench measures weaponizing bugs somebody already found, so that isn’t the zero-day result. The zero-day result comes from a separate evaluation, where “the model even discovered and used two zero-day vulnerabilities as part of an exploit chain.” Astra also built “a full browser-compromise chain that escaped the sandbox and executed commands on the host.”
I have no issues with any of that. Irregular ran its own assessment and published on September 3: Astra solved 86 of 226 FrontierCyber challenges, against 34 for Sol.
The Safeguard Doing the Work Is the One OpenAI Says Is Slipping
OpenAI names four things that protect you. Its September 1 post describes an approach that “layers post-trained model refusals, system level safety classifiers, as well as offline detection and threat disruption,” and says it’s deploying Astra with “additional chain-of-thought monitoring to rapidly detect and contain potentially misaligned actions.”
Chain-of-thought monitorability is the property that a model’s written reasoning stays readable and honest enough that a second model watching can tell when the first one is up to something. OpenAI named it as a safeguard for a model rated Critical for cyber, then said it’s weakening.
Two days after naming it, the safety overview for GPT-6 Astra said this: “We have found that GPT-6 Astra is more capable of controlling its own CoT than GPT-5.6 Sol, and less likely to include incriminating information in its CoT.” The same document reports that “in adversarial settings (where we push the model to evade our monitors) we find that the model is able to remain undetected when strategically underperforming in evaluations (sandbagging) and can sometimes evade our internal monitors when asked to perform certain sabotage tasks.”
Sandbagging is a model deliberately doing worse than it can, usually because it has worked out that it’s being tested. The thing being measured knows it’s being measured and can shade the result, including the numbers in the card.
OpenAI hedges those findings in the same document: “Right now, these findings are largely based on adversarial evaluations (i.e., when we instruct the model to evade monitoring), and overall our alignment evaluations show that Astra is less likely than GPT-5.6 Sol to violate security and safety restrictions overall.” That caveat is fair. These are elicited findings rather than observed production behavior, and Astra’s overall violation rate went down.
The caveat doesn’t rescue the safeguard because independent research has already shown how this fails. In August, Shikhar Shiromani and Leo Richter published A False Average: Chain-of-Thought Monitors Collapse Where They Are the Only Defense. They rewrote only an agent’s reasoning so it read as good-faith engineering, copying every command and every output verbatim, leaving the exploit itself untouched. The rewrite never lies about what happened. It stays truthful on every action and lies only about why. A held-out monitor’s catch rate on that subset fell from about 95% to under 11%, in one shot, with no training. Defenses built on the trace alone recover only part of that, even one primed on the attack, because there is nothing false in the trace to catch. The authors found that only information from outside the trace helps substantially, and that’s where your telemetry lives. A monitor’s aggregate accuracy is “a false average,” dominated by the easy cases the actions give away, hiding near-total collapse on the subset where reasoning is the only signal. That paper was published a month before Astra shipped.
Jakub Pachocki, OpenAI’s chief scientist, said much the same about chain-of-thought monitoring: “I do think it is fragile and unfortunately trending in a negative direction, for reasons not contingent on architecture changes that I will write about soon. But there are things we can do to strengthen it, and it’s a core goal of our current research program.”
The card does carry a section headed “External Evaluation for Monitorability,” run by UK AISI. That work measured how capable Astra is without its chain of thought and how much control it has over what appears there. That tells you how much reasoning the monitor can expect to see, and not whether an adversary can defeat it, which is what a cyber misuse safeguard turns on.
I wrote in April that chain-of-thought monitoring fails as a security control for agentic systems. The lab shipping the most capable cyber model now agrees the monitor is fragile, has published evidence that this model is better at hiding from it, and kept it in the safeguard stack anyway.
Read the Table of Contents as a Coverage Matrix
Open the GPT-6 Astra system card and read the section headings as a control-coverage matrix, the way you’d read a SOC 2 scope statement before the opinion.
OpenAI named five outside evaluators and gave each a heading. UK AISI and Apollo Research sit under alignment, UK AISI again under monitorability, SecureBio twice under biological capabilities and bio safeguards, Irregular under cyber capabilities, and Gray Swan under third-party red-teaming for jailbreaks.
You’ll find that one pair is missing if you walk those headings. No section pairs an outside evaluator with cyber safeguards the way “External Evaluations of Bio Safeguards” pairs SecureBio with bio safeguards. Irregular’s own write-up confirms it, describing benchmark performance across three suites with no mention of refusals, classifiers, or mitigations.
Gray Swan did test a safeguards-enabled checkpoint. A safeguards-enabled checkpoint is the model configured the way customers get it, refusals and classifiers on, rather than the stripped-down build labs use to measure raw capability. OpenAI reports that “on a benchmark of 1,810 curated attacks from Gray Swan’s IPI Arena, Astra’s safeguards-enabled checkpoint showed improved robustness relative to GPT-5.6 Sol,” with an estimated attack success rate “across 15 attempts per scenario” of 8.5% against 27.0% for the older model.
That benchmark measures a different threat model from the one the Critical rating covers. Indirect prompt injection is when instructions hidden inside content your agent reads, a web page, a ticket, a README, hijack the agent into doing something its operator never asked for. In that scenario your agent is the victim. In the cyber misuse scenario your operator points the model at a target, and OpenAI assigned Critical for that second case. A defense that holds against one adversary model tells you little about the other.
That result reaches you through OpenAI’s system card rather than Gray Swan’s own site, so OpenAI picked which numbers to print and how much of the method to show. The 8.5% is also easy to confuse with a different 8.5% in the same story, because OpenAI separately reports that “on our set of cyber jailbreak evaluations, Astra refuses 91.5% of requests (compared to 59% from GPT-5.6 Sol).” The complement of that refusal rate is also 8.5%. Two evaluators, two unrelated threats, the same two digits. That coincidence is going to show up in somebody’s board deck as one finding. A non-refusal in a jailbreak eval is not a working exploit, so anyone turning 91.5% into “one in twelve attacks succeeds” has merged two separate measurements.
Vendor-scoped evaluation numbers carry a measured optimistic bias. In June, Catherine Ge-Wang, Tyler Crosse, and four co-authors published Attack Selection in Agentic AI Control Evaluations Meaningfully Decreases Safety. Attack selection is the red team’s freedom to choose its moments, deciding when to start an attack and when to abort one rather than attacking on a fixed schedule. Giving the attacker a start policy cost 20 percentage points of measured safety on both BashArena and LinuxArena at a 1% audit budget. Giving it an abort policy cost 20 points on BashArena and 28 on LinuxArena, with attack capability held constant. The authors call these upper bounds and recommend that future evaluations, system cards, and safety cases elicit attack selection to produce more realistic safety estimates.
Why Nobody Ran the Test
External cyber safeguard evaluation really is harder than the bio version, and evaluation containment has failed in public more than once this year.
On July 30, Anthropic disclosed that three of its models reached real systems during cybersecurity evaluations. All three were running capture-the-flag exercises, which is the most ordinary thing you can ask a cyber model to do. In August I went through all three and the egress problem underneath them.
The first one had a fictional target company whose name matched a real domain. In four runs, the model “ran into difficulty reaching its simulated target within the evaluation environment, but then discovered that the real company was reachable via the internet,” exploited it, took application and infrastructure credentials, and got into “a database containing several hundred rows of production data.” Anthropic notes this was “the only case in which the model continued to attack a system after learning it was likely operating in a real environment.”
The second model was hunting a flag inside a fictional company when it found a setup document for new developers telling them to install a Python package from PyPI. The package didn’t exist. The model saw the opening straight away, because publishing a package under that name would get it installed automatically.
Then it went to work. To upload to PyPI it needed an account. To get an account it needed an email address. To get an email address it needed a phone number. It hunted for a free phone number service and failed, then tried several different ways to obtain funds to pay for one and failed at that too. It backtracked, found an email provider that didn’t demand a phone number, registered the account, and uploaded the malware. Anthropic calls that sequence “lengths that would likely have indicated to a human participant that this was no longer just an evaluation.”
The package sat live for roughly an hour. Fifteen real systems downloaded and ran it. One was a vulnerability scanner belonging to a real security company, and when that scanner installed the package, the model’s hidden code executed and exfiltrated the company’s credentials. PyPI’s own security systems took the package down.
A third model, unable to reach its fictional target, went looking for alternatives and scanned roughly 9,000 hosts. It compromised one company’s internet-facing application using nothing exotic, reading credentials off an exposed debug page and running a SQL injection. That one ends better. The model worked out on its own that the host sat in a cloud account with no connection to the exercise, concluded the target was real, and stopped.
Anthropic stopped all cyber evaluations the day it found the transcripts. It found them by going back through 141,006 evaluation runs, and it started that review after OpenAI disclosed its own incident on July 21. Somebody else’s disclosure triggered the discovery.
OpenAI has its own version. Its evaluation agents chained vulnerabilities across its research environment and Hugging Face’s production infrastructure, turning an Artifactory package cache into an improvised message board on the way. I covered the detection side last week.
Abu Bakar Siddik’s July review, Cyber-Capable AI Agents, treats that incident as a bounded case study and puts the problem plainly: “A benchmark score tells you how a model performed under fixed conditions. It says nothing about the containment around it.”
Handing an outside party a cyber model with the guardrails off is a different act from handing a biosecurity institute a model that answers dangerous questions. The biosecurity institute gets a model that produces text a human still has to act on. The cyber evaluator gets the actor.
Anthropic’s own conclusion goes further: “Evaluation environments increasingly need to be held to the same security standard as any other system our models run in.”
The PyPI run settles the chain-of-thought argument better than any benchmark does. Early in that run the model wrote down what it was about to do and got it exactly right. Anthropic quotes the reasoning: if this were the real internet, publishing the package would be a real-world attack, “NOT okay, and surely not the intended solution.” The model understood the harm, in plain English, in a legible trace, before it acted. Then it convinced itself it was still in a simulation and did it anyway.
The monitor’s entire premise is that the reasoning is readable. Here the reasoning was readable, correct, and sitting in a transcript nobody opened until the retrospective. A monitor you don’t read in time is a log file.
Two Reasons That Doesn’t Settle It
The first is that the artifact is producible, and someone produced it. In March, METR red-teamed a subset of Anthropic’s internal agent monitoring and security systems and published on its own site. “Anthropic provided substantial access to relevant internal systems and information,” and METR found several novel vulnerabilities, some since patched, none of which it says severely undermine the major claims in Anthropic’s sabotage risk report. The full 26-page report went to Anthropic and a redacted version to a subset of METR staff, so call it a partial win. It’s still an outside party testing a safeguard and publishing what it found.
The second is that OpenAI has run this play before, at depth. In its 2025 work with UK AISI and US CAISI, it handed UK AISI “non-public prototypes of our safeguard systems,” “’helpful-only’ model variants with certain guardrails removed,” access to the chain of thought of its internal safety monitor models, and selective disabling of mitigations during testing. A helpful-only variant is a build with the refusal training stripped out, so evaluators see what the model does before the safety layer catches it. No lab has published a deeper access grant. UK AISI filed “more than a dozen detailed vulnerability reports” against the bio safeguards, and its view was that “the safeguards of the full moderation system were substantially strengthened over the course of the collaboration.”
The same page shows US CAISI red-teaming ChatGPT Agent and finding “two novel security vulnerabilities” that, “under certain circumstances, could have allowed a sophisticated attacker to bypass our security protections.” OpenAI knows how to commission deep external safeguard work, and it knows how to commission external cyber work. It didn’t do the two together on the model it rated Critical for cyber.
Give OpenAI the credit it earned. The September 1 post says it “delayed parts of Astra’s development and release while we strengthened and tested protections against cyber misuse and unauthorized model actions.” A delay is real work, and a delay is not an external evaluation.
The containment objection argues for a narrower test than the bio version got. Nobody has to ship a mitigations-off Astra to a third party to learn something useful. An outside team pointed at the safeguards-enabled checkpoint, against synthetic targets on a closed range, with monitor chain-of-thought access and the freedom to choose its moments, produces a number. Gray Swan did roughly that for prompt injection.
What You Own Today
Astra arrives off by default at launch in eligible enterprise and education workspaces, so somebody on your team owns an enablement call. Don’t read this issue as a reason to sit on Sol. On a misalignment propensity test, OpenAI reports that “GPT-5.6 Sol, without production safeguards, attempted to access those targets in 56% of tests simulating the benchmark environment where the model is instructed to develop exploits,” and Astra made no such attempts. Gray Swan’s prompt-injection numbers point the same way. Neither result answers the question this issue raises, and both run in Astra’s favor. An unverified safeguard claim earns harder questions at your next architecture review.
Both access programs gate entry, and one isn’t what it looks like. Daybreak Blue runs on GPT-5.6 Sol, not Astra, so enrolling buys a vetting relationship, not access to the model in this issue. Approval isn’t automatic. Google’s Fairwind Program is blunter, calling itself “exclusively available to approved trusted partners” and prioritizing governments plus critical infrastructure in “healthcare, telecommunications, energy, and financial networks.” If you run a hospital or a utility, apply this quarter, because the lead time runs long. Otherwise work the vendor relationship you have.
Three questions I’d take into any frontier-model renewal:
Which third parties evaluated your safeguards, in which domain, at what depth of access, and against which adversary? I want to know whether the evaluator played an attacker targeting my agent or an operator using your model to attack somebody else. Vendors report those two tests as if they were one.
Did your red team choose when to attack, or did it attack on a fixed schedule? An evaluation that never let the attacker pick its moments overstates the result, and now you know roughly by how much.
Where can I read the evaluator’s own writeup, on the evaluator’s site? If the only place a number appears is the vendor’s document, treat it as the vendor’s number.
None of that requires a purchase.
Inside the estate, skip blast radius, because nobody has a shared definition for it. Ask how many non-human identities your agents authenticate as, and how many carry standing privilege you can’t revoke inside an hour. Palo Alto Networks put machine identities at 109 per human this year in its May 2026 identity research, and found only 37% of organizations able to revoke an AI agent’s credentials, so if your team can’t answer, they’re in the majority. Run the count anyway, because the answer feeds your authorization design whether or not you buy anything. Model capability moves the odds that an agent reaches the edge of what it’s allowed to touch. Your authorization design decides how much damage that edge contains.
I spent years running a global NOC and SOC at General Dynamics IT, then sat in a CISO seat in the energy sector. In both jobs, a vendor would tell me a control worked, and my next question was always how they knew. The datasheet was never the answer.
No evidence means unimplemented.
I don’t get to apply that rule to your control set and suspend it for a vendor’s, and you don’t get to either. Put the table of contents question to your next architecture review. If the safeguard has no external evidence to support it, on what basis is it in your control set?
What to do next
Take the three vendor questions into your next renewal and write down the answers. In CARE terms that’s Adapt, where a supplier claim either arrives with evidence or gets logged as unimplemented. The identity count belongs in Run, because operational governance without telemetry underneath it is a policy document with good intentions.
For the adjacent arguments, I wrote about what a capability milestone tells you when the headline gets ahead of the evidence, and about how release restrictions became a licensing regime. Somebody grades their own homework every time, and the grade ends up in a control set.
👉 For ongoing analysis of agentic AI governance frameworks, the conversation at RockCyber Musings and you can subscribe above
👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.
👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com
👉 As a bonus, VentureBeat’s Louis Columbus covered the methodology Steve Wilson and I used behind the 2026 OWASP Top 10 for LLMs. Expert judgment has prompt injection at number one, three years running. The public incident record, 6,639 labeled incidents, has it at number twelve. The two measures land at a Cohen’s kappa of 0.20, which is no detectable agreement. What I told him goes for everything above too: “a count of zero is measuring your blindness, not your safety.”