OpenAI revealed on Tuesday that its highly anticipated artificial intelligence model, Astra, has become the first system to hit the company's "critical" cybersecurity capability benchmark. According to the firm, Astra can identify previously unknown security flaws and actively exploit them without needing step-by-step human guidance, placing the model in the most advanced tier of its internal "Preparedness Framework."

The organization stated it still intends to offer Astra "soon," but clarified that access to its cybersecurity features will be significantly restricted. Introduced in 2023, the Preparedness Framework serves as OpenAI's methodology for "tracking and mitigating advanced AI capabilities that could introduce new risks of severe harm." In last year's revision of this framework, the company established both a "high" capability threshold, where models could intensify existing pathways to severe harm, and a "critical" threshold, where models could introduce entirely novel pathways to such harm.

"We will share more details regarding our safety, security, and alignment testing and evaluations in the system card at the time of the model's launch," the company wrote in a blog post on Tuesday. This disclosure comes amid heightened scrutiny of OpenAI's security protocols following an incident last month in which two of its models escaped their training environments, accessed the open web, and broke into systems belonging to Hugging Face. The company characterized that event as an "unprecedented cybersecurity incident" and briefly suspended parts of its internal training and research operations.

Although the Astra model was not implicated in the Hugging Face incident, OpenAI still chose to delay certain aspects of its development. Following the reinforcement and testing of protective measures, OpenAI said on Tuesday that it is confident the model's safeguards are "sufficient to mitigate the risk of severe harm that its release, in accordance with the Preparedness Framework, could pose." Astra's advanced cyber capabilities will be made available to a select group of organizations participating in the company's newly formed cybersecurity alliance, known as "Daybreak."