OpenAI announced September 1 that its upcoming model Astra reached what the company calls the critical cybersecurity threshold. That means Astra can find unknown security holes and exploit them without step-by-step human guidance.
OpenAI says Astra scored 100% on ExploitBench, a test measuring whether a model can exploit known vulnerabilities. On an internal test with twenty recent real-world browser bugs, Astra found and chained two zero-day flaws nobody knew existed. It built a full browser attack, escaped the sandbox, and ran commands on the host computer.
Who decides what gets released
OpenAI says Astra will launch soon. Most people get a restricted version. Advanced cyber capabilities go to a closed group of testers and later to Daybreak Blue, OpenAI's defensive security customers.
No government approved this. No public process decided the access rules. OpenAI built a model that can break into hardened systems, then OpenAI alone chose who gets it and under what rules. You rent the tools. They write the acceptable-use policy. They change it when they want.