OpenAI 称 Astra 是其迄今最危险的模型，而看清它在做什么正变得越来越难

OpenAI is rating its upcoming Astra model as the first system with "critical" cyber capabilities, while promising it's also the safest model the company has built. But a report on Astra's architecture raises questions. It's an unusual way to announce a product: OpenAI says its upcoming Astra model is so dangerous that it hits the highest risk tier for cybersecurity in the company's own Preparedness Framework , and in the same breath calls it the safest model it has ever built. Given the right tools, Astra can find and exploit previously unknown security holes in well-protected systems, without a human guiding each step. No model before this got that rating from OpenAI, though the company had already hinted Astra might get there. The timing is probably no accident. The warning landed the same day rival Anthropic shipped Claude Fable 5.1 and Mythos 5.1 , and the two companies have a habit of dropping announcements right around each other's releases. On X , CEO Sam Altman explained why his company isn't shipping anything new: the team spent the summer "sprinting on safety priorities," Astra "has been done training for a while now," and the models after it are being slowed down on purpose. Users on X read that as an excuse from a company falling behind. According to The Information, Anthropic passed OpenAI on revenue this year. OpenAI backs up the critical rating with a batch of tests. On ExploitBench, a benchmark that measures how well a model builds exploits from known vulnerabilities, Astra scored full marks. Worried those tasks might have leaked into its training data, the company built an internal follow-up stocked with 20 recently disclosed, high-severity V8 vulnerabilities. There too, Astra beat its predecessor GPT-5.6 Sol by a wide margin, while burning far fewer tokens. It also found two previously unknown zero-day flaws and chained them into a working exploit. OpenAI says it's now reporting those vulnerabilities to the people responsible for the affected software. In expert-led tests, the model went further. It built a full compromise chain against a browser, broke out of the sandbox, and ran commands on the host the moment the browser opened an HTML file. In an operating system, it combined several flaws to climb from an unprivileged user all the way to root. One caveat: these results came from the expanded "Daybreak Blue" access, not the standard setup regular users get. In July, misfiring OpenAI agents hijacked one of the company's own research compute clusters , grabbed credentials for internal systems, and possibly exposed research infrastructure to the internet, part of the same incident that hit Hugging Face. Astra wasn't involved, but OpenAI says the agents ran on a model with similarities to it. After the incident, the company paused certain frontier training for two weeks and didn't restart the big reinforcement learning run for Astra's successor until August 28, under tighter rules. OpenAI plans to counter these dangers on several fronts. In internal evaluations, Astra refuses 91.5 percent of disallowed cyber requests, compared with 59 percent for GPT-5.6 Sol. In a honeypot test modeled on the July hack, GPT-5.6 Sol tried to compromise surrounding security infrastructure instead of solving its task 56 percent of the time. Astra made no such attempt at all, and in another evaluation it never bypassed the auto-review check. Both numbers came from test conditions without the production safeguards, so they don't describe normal use. OpenAI still calls Astra its "most aligned model to date." In production, classifiers are supposed to watch the model's chain of thought and automatically stop suspicious activity. For users, that could mean real friction. OpenAI says the checks can slow down, pause, or cancel legitimate work, even work with nothing to do with cybersecurity. The advanced cyber features go to a small group of alpha testers first, before access widens through Daybreak Blue for defensive use. Bu