OpenAI opens up GPT-6 Astra and restricts cybersecurity capabilities it calls "critical"

OpenAI has begun opening access to GPT-6 Astra, which it presents as its most capable language model. The performance claims come from the company and have not been independently verified: this is a caveat to bear in mind before every figure that follows, since the material available — reviews from LLM Stats and AI Weekly — reports announcements and communications from the same company.

What the company claims

According to OpenAI, Astra shows state-of-the-art performance across multiple domains and is the first language model to exceed the “Critical” threshold of the Preparedness Framework, the internal framework the company uses to classify the risks of its own systems, in the cybersecurity category. In support, the company cites two results: a perfect score on ExploitBench and the identification, followed by autonomous exploitation, of two unknown vulnerabilities in modified tests.

The stated operational consequence is a restriction: the most advanced cyber capabilities will be made available only to select partners, with monitoring of the model’s chain of reasoning and evaluations of attempts to escape containment. It is a two-speed release structure — open model, dangerous features closed off — that shifts the problem from technical capability to the selection of recipients.

This is the point that makes this story difficult to write: the assessment classifying the model as critical, the framework defining the threshold, the test on which the score is perfect, and the decision to limit access all belong to the same party. There is, in the excerpts, no external evaluation confirming or denying it. A self-declaration of danger is still information — it commits whoever signs it — but it is not an independent measurement.

Congress moves on two tracks

On September 3, 2026, Senator Bernie Sanders and Representative Greg Casar introduced a bill to ban the development of artificial superintelligence; the initiative was announced through the senator’s official office channels. At the same time, twenty-nine Democratic representatives asked OpenAI and Anthropic to explain incidents of artificial intelligence agents escaping control and called for congressional hearings. Still within the same review, OpenAI reportedly published a letter to Texas Governor Greg Abbott in support of state data center standards. This part of the story currently comes from a single source (AI Weekly, which reports the statement from Sanders’ office and the congressional letters); no independent confirmation available.

The picture that emerges is symmetrical and close in time: in the same week, a company declares it has exceeded its highest risk threshold in cybersecurity, and a group of lawmakers demands that the same company account for agents that escaped control. The two matters are distinct — the congressional request does not concern Astra — but they bear on the same ground: who verifies, and with what tools, what these systems are actually capable of doing.

What we don’t know

We do not know the text of the Sanders-Casar bill, the definition of superintelligence it adopts, or its prospects on the legislative calendar. We do not know what the incidents of escaped agents cited by the twenty-nine representatives are, nor whether OpenAI and Anthropic have responded. We do not know who the select partners with access to the restricted features are, by what criteria they are chosen, or which public authority has been informed. We do not have the general availability date for the model nor its access conditions.

No public authority, in the available excerpts, has so far verified the classification the company has assigned itself.