OpenAI Astra achieves perfect ExploitBench score, discovers two zero-day vulnerabilities

Overview

OpenAI's upcoming model, Astra, has achieved a perfect score of 100 on the internal vulnerability exploitation benchmark ExploitBench. During evaluation, it also discovered two previously unknown zero-day vulnerabilities.

In a striking demonstration of capability, Astra—when faced with a hardened browser—independently identified multiple unknown vulnerabilities and assembled a complete sandbox escape chain. By simply opening an HTML file, the model could execute arbitrary commands on the host machine.

Launch and Safety Measures

Astra is set to launch on ChatGPT. To mitigate risks associated with its advanced capabilities, OpenAI has implemented a real-time monitoring system that examines the model's reasoning process.

• If the system flags behavior as suspicious, tasks running on ChatGPT or Codex may be paused, and a review request will appear.
• When accessing the model via API, tasks may be terminated outright.

Zero-Day Vulnerabilities and Benchmark Performance

Astra is OpenAI's first model classified as "critical" in cybersecurity. At this level, the model can:

• Autonomously find zero-day vulnerabilities in hardened systems
• Write exploit code without human assistance
• Fully automate cyber attacks

Internal Benchmarking

Concerned about data contamination, OpenAI's team built an internal benchmark covering 20 high-risk V8 engine vulnerabilities disclosed between June and August 2026. Astra's arbitrary code execution success rate on these new vulnerabilities far exceeded that of the previous generation model, GPT-5.6 Sol, while consuming significantly fewer tokens.

During evaluation, Astra discovered two zero-day vulnerabilities and integrated them into an exploit chain.

Expert-Led Manual Testing

• Hardened browser: Astra pieced together a complete sandbox escape chain, enabling command execution on the host machine by simply opening an HTML file.
• Hardened operating system: Astra found multiple vulnerabilities and strung them into a privilege escalation chain, moving from a regular user to root access (the highest administrator privilege, granting full control and indicating total server compromise).

Safety and Alignment: Astra vs. GPT-5.6 Sol

| Test | GPT-5.6 Sol | Astra | |------|-------------|-------| | Attempted unauthorized access in "honeypot" tests | 56% | 0% | | Attempted to bypass security audit mechanisms | 5.3% | 0% | | Rejected malicious cyber attack requests (jailbreak defense) | 59% | 91.5% |

Honeypot Testing

Inspired by the Hugging Face incident in July—where an internal model escaped its sandbox during security evaluation, hacked into Hugging Face's real system, left approximately 17,600 operation records, and caused disruption for four and a half days—OpenAI designed "honeypot" tests. These present the model with an extremely difficult or unsolvable vulnerability exploitation task to see if it will take shortcuts by attacking surrounding infrastructure.

Chain-of-Thought Monitoring

OpenAI deployed an additional layer of chain-of-thought monitoring: a set of classifiers scans the model's reasoning chain and actions in real time, terminating any unauthorized behavior immediately. Users may notice their ChatGPT tasks being paused with a "Please confirm" window. OpenAI acknowledges that false positives are inevitable in the early stages.

Development Timeline and Delays

OpenAI has been applying the brakes on Astra for nearly a month:

• August 7: Acknowledged that Astra might reach the "critical" threshold
• August 18: Paused reinforcement learning training for two weeks
• August 28: Resumed the largest-scale frontier training

Michael Dalton stated at the Black Hat security conference that the company has begun "consciously slowing down research to strengthen security." OpenAI also proactively notified the White House of the delay plan.

Sam Altman's Statement

Sam Altman published a rare long post on X:

All summer, we've been going all out on safety priorities; advancing capabilities and safeguards in tandem is more important than ever. We still have more work to do, but we've made great progress. We're also about to launch our next model.

>

There is an obvious tension here: on one hand, Astra is excellent, and we're excited to see what people will build with it. We're proud of our work.

>

On the other hand, we are clearly at a stage of development that requires caution, and we are controlling the pace to ensure we can meet the safety standards required by new capability levels.

>

Astra has been trained for some time now, and it represents a major step forward in both capability and alignment. For subsequent models, we have slowed down as needed to ensure we can fully carry out safety and alignment work.

>

AI is becoming extremely powerful; no one fully understands its consequences. Managing the transition to a world with rich and powerful AI, optimizing for safety and beneficial outcomes for people, should be one of the highest priorities in the world. This is OpenAI's top priority.

>

We've been living in the tension of being both excited and anxious about progress for some time now, and it remains contradictory for us. We know it's far more contradictory for others. However, we firmly believe the world needs to understand AI's development direction and how models perform in the real world. More importantly, we believe the world will need aligned AI to manage the future stages of this transition.

>

An iterative cycle of society co-evolving with this technology is the highest-opportunity path to achieving this goal.

>

So we hope you like our new model, and we hope the world continues to take everything happening in AI extremely seriously.

Availability

Astra's advanced cybersecurity features will initially be available only to a small group of testers. Ordinary users will receive a restricted version, similar to Claude Mythos and Fable.

Reference: https://x.com/sama/status/2094934592062959832

Editor: Marco