GPT-6 Astra Hits 100% on ExploitBench

OpenAI shipped GPT-6 Astra on Thursday, September 3, and disclosed that it scores 100% on ExploitBench, the benchmark that measures whether a model can turn a known vulnerability into a working exploit. The prior frontier model, GPT-5.6 Sol, scored 78.5%. That is a 21.5 point jump in one release cycle, and it is the first time a publicly announced commercial model has saturated that benchmark.

Days before the launch, OpenAI stated Astra had crossed the "Critical" cybersecurity capability threshold in its Preparedness Framework. That is the company's own top rating for offensive cyber capability. The version being released is deliberately clipped: it will do secure code review and patching, and it refuses prompts asking for proof-of-concept exploits.

The numbers that matter

ExploitBench is the headline, but the more useful datapoint is the live testing. OpenAI says Astra achieved substantially higher arbitrary code execution rates than GPT-5.6 Sol against flaws disclosed between June and August 2026, a three month window of fresh CVEs. Two of those were zero-day vulnerabilities in unnamed software.

• 100% on ExploitBench for Astra, up from 78.5% for GPT-5.6 Sol
• Higher arbitrary code execution rates on vulnerabilities disclosed June to August 2026, including two zero-days
• Code execution in hardened browsers using previously unknown vulnerabilities, when run without safeguards
• Privilege escalation exploit development against hardened operating systems, same caveat
• 98% on FrontierMath Tier 4 and 99.9% on ARC-AGI-3, as context on general capability

Read the caveat carefully. "If allowed to run without any safeguards" describes the unrestricted model, not the one in ChatGPT today. It also describes exactly what a stolen weights scenario, a successful jailbreak, or an open-weight model that catches up in twelve months would look like. Benchmarks measure capability. Guardrails are a product decision that can be changed, bypassed, or replicated by someone with no interest in guardrails.

What OpenAI is shipping versus what it built

Distribution matters as much as capability. Astra is rolling out to a small set of organizations first, then to ChatGPT Plus, Pro, Business and Enterprise users, plus the OpenAI API, Microsoft Azure and AWS Bedrock. That is three major cloud platforms. The shipping configuration is restricted to defensive work: secure code review and patching, with PoC generation refused.

The restrictions loosen soon. Through a program called Daybreak, OpenAI plans "less restrictive safeguards in the coming weeks" to enable vulnerability and proof-of-concept validation, malware analysis and detection engineering. The PoC refusal you see today is temporary and gated, not permanent policy.

On misuse, OpenAI cites stronger jailbreak robustness, more context fed into its monitoring systems, and added safeguards to detect and contain misalignment. The company also concedes that safety checks will sometimes interrupt legitimate work, including defensive security tasks, prompting the user to approve the action before continuing. Expect friction if you wire this into automated pipelines.

The $1 billion defender subsidy

Alongside the model, OpenAI announced Daybreak for Frontline Defenders, a $1 billion commitment providing subsidized model access, training and hands-on technical assistance to critical infrastructure and under-resourced organizations: water systems, electricity providers, state and local government, banks, non-profits and open-source maintainers. A pilot with the U.S. Multi-State Information Sharing and Analysis Center (MS-ISAC) puts an initial group of public sector and water system defenders on Daybreak access first.

Water utilities and SLTT government are the right targets. They are also the sectors with the fewest people available to operate anything they are given. Subsidized access to a frontier model does not fix a two person IT shop running a municipal SCADA network. The training and hands-on assistance components are the parts of this announcement worth watching, and the parts hardest to scale.

What this changes for defenders

The practical shift is timing. OpenAI's framing is a "defender's window", a narrowing period in which AI closes security gaps before attackers seize the same capability. Treat that as a planning assumption rather than a promise. The capability described in Astra's disclosures is what a well funded adversary is already building toward with fewer restrictions and no refusal layer.

• Compress the patch SLA for internet-facing systems. If your window for critical external CVEs is 30 days, that number was set in a world where weaponization took time.
• Instrument for exploitation attempts, not exploit availability. Detection engineering that waits for a public PoC before writing a signature is now structurally behind.
• Test your jailbreak assumptions. If your team uses hosted models in security workflows, know where the refusal boundary sits and log every prompt that trips it.
• Audit permissions granted to AI agents in your environment. OpenAI says Astra is "more likely" to operate within limits implied by its environment, which is a design goal, not a guarantee.
• Apply for Daybreak if you are in water, energy, SLTT government, or a small non-profit. Subsidized frontier access is worth the paperwork.

The bottom line

One vendor, one benchmark, one set of self-reported numbers, and no third party has audited the ExploitBench result. That is the limit of what is known today. What is not in dispute: OpenAI rated its own model "Critical" for cyber capability, shipped it across three cloud platforms, and committed $1 billion to putting it in the hands of defenders who currently cannot afford it. Both halves of that sentence are the story.