Preparing for Impact: OpenAI Confirms Astra AI Model Can Automatically Find Zero-Day Vulnerabilities and Generate Exploit Code

484/69 Friday, September 4, 2026 OpenAI has classified its new artificial intelligence (AI) model, Astra, at the highest cybersecurity risk level, Critical, under its Preparedness Framework. This marks the first model from the organization to reach this level. The assessment indicates that the system is capable of finding zero-day vulnerabilities and systematically developing exploit code against heavily defended systems without requiring human direction at every stage. This development means that technology organizations and cybersecurity administrators need to prepare for changes in the evolution of AI-driven cyberattacks. In in-depth testing, Astra achieved a full 100% score in converting vulnerabilities into exploit code on ExploitBench and outperformed the previous GPT-5.6 Sol model in tests involving V8 vulnerabilities. Performance results showed that Astra, when used with the Daybreak Blue configuration, achieved a peak successful code-processing rate of nearly 40% while using approximately 75,000 tokens. In comparison, GPT-5.6 Sol achieved only around 12% while consuming nearly 140,000 tokens. In addition, Astra discovered two new zero-day vulnerabilities while building exploit chains, including a browser compromise that bypassed sandbox protections to execute commands on a victim’s machine, and a privilege escalation path from a standard user to root privileges on the operating system. To reduce risk, OpenAI temporarily paused model training to strengthen isolation, increase monitoring, and improve the refusal rate for harmful requests to 91.5%. The development of AI models at this level shows that traditional vulnerability patching timelines may not be fast enough to address future threats. OpenAI has restricted access to Astra’s advanced capabilities to a limited group of testers and continues development through the Daybreak Blue program, emphasizing defensive and protective use cases. Cybersecurity administrators and organizations should accelerate efforts to improve proactive vulnerability discovery and assessment processes, shift their strategies from passive defense to proactive threat hunting, and enhance threat detection and response capabilities to reduce the likelihood that new vulnerabilities will be exploited before systems are patched.