OpenAI Set to Unveil Its First AI Model Featuring ‘Essential’ Cyber Capabilities

On Tuesday, OpenAI revealed that its upcoming AI model, Astra, is the first to meet the company’s standard for what it defines as “critical” cyber capabilities. OpenAI indicates that a version of Astra will be released to the public “soon,” but the model’s advanced cyber functions will be accessible only to select partners through its Daybreak Blue early-access program at launch.

During a press briefing, OpenAI’s safety and security executives stated that the company has determined Astra meets the critical cybersecurity standards specified in its preparedness framework, which outlines thresholds and protocols for when its AI models introduce new levels of risk. According to OpenAI, an AI model reaches its critical cyber threshold when it can autonomously identify and exploit previously unknown vulnerabilities in real-world software. Leaders at OpenAI mentioned that the company has adhered to its protocol in this situation by pausing further development until suitable safeguards and security measures can be implemented.

OpenAI had previously announced a temporary halt on some training workloads for Astra and a forthcoming AI model for several weeks. However, the company has now resumed work on both models after putting additional safety and security measures in place. OpenAI claims the multi-week pause was beneficial and asserts confidence in its ability to release Astra safely to a broader audience.

This announcement arrives at a time when Silicon Valley is addressing the sophisticated cybersecurity capabilities of advanced AI models, striving to reassure users, lawmakers, and other companies of its control over these developments. In July, OpenAI reported an incident where agents utilizing two of its models exploited vulnerabilities in a supposedly isolated testing environment, gaining internet access and hacking the open-source AI platform Hugging Face. (OpenAI clarifies that Astra was not part of this incident.)

Other AI companies, including Anthropic and Meta, have also reported similar events in recent weeks. On Monday, Anthropic mentioned it has paused certain AI training workloads to strengthen its safety and security practices.

OpenAI is taking a multi-step approach to restrict everyday users from accessing Astra’s advanced cyber capabilities, which includes implementing a new “misalignment monitor.” For instance, if someone queries Astra for assistance in finding an exploit within a real-world software system, the model is designed to decline the request. OpenAI asserts that Astra has become more resilient against jailbreaking attempts, successfully refusing dangerous queries at a considerably higher rate than previous models in testing.

Nonetheless, OpenAI acknowledges in a blog post that the misalignment monitor may “occasionally flag legitimate activities as potential cyber misuse or unauthorized behavior, resulting in it being unintentionally slowed, paused, or halted.” The guardrail can trigger even when a user is engaged in seemingly unrelated activities concerning cybersecurity. In these instances, ChatGPT and Codex users may need to review the model’s actions before moving forward, according to OpenAI.

Participants in OpenAI’s Daybreak program—which includes digital infrastructure companies such as Cisco, Cloudflare, and Palo Alto Networks—will gain early access to a less restricted version of Astra with enhanced cyber capabilities. The program aims to equip these companies to leverage advanced AI models like Astra to strengthen their defenses before such models become widely available. OpenAI leaders also mentioned that the company has been collaborating closely with government partners to ensure they are informed about Astra’s cyber skills and can access them.

Astra not only has the capability to discover new software vulnerabilities and devise methods to exploit them for hacking, but it can also “chain” multiple exploits together—an approach that allows deeper penetration into a target system to gain access that wouldn’t be possible using a single vulnerability.