Astra Scored 100% on ExploitBench. That Is a Risk Disclosure

Most of the GPT-6 Astra coverage went to the AGI argument. The more consequential number got a paragraph: Astra scored 100% on ExploitBench and is the first model OpenAI classes as crossing its Critical threshold for cyber capability.

That is not a marketing figure. It is a company publishing that its own product can find previously unknown vulnerabilities and build working exploits.

OpenAI's preparedness framework defines capability thresholds with required safeguards attached. Crossing into Critical is the company saying a model has reached a level where the downside case is severe enough to need specific mitigations rather than general ones. This is the first time that threshold has been crossed on cyber.

The same disclosure reports that Astra's reasoning is harder to read than its predecessor's, that chain-of-thought monitoring is fragile, and that the trend is in a negative direction.

• ▸Defensive tooling built on frontier models gets better at the same rate as offensive tooling, and both sides now have access to the same capability.
• ▸Vulnerability disclosure timelines assume finding bugs is slow and expensive. That assumption is weakening.
• ▸If you run anything internet-facing, the practical change is boring and immediate: patch faster, because the window between a vulnerability existing and being found is shrinking.
• ▸For local models specifically, nothing changes. Open-weight models at the sizes you can run at home are nowhere near this capability level.

Vendor safety disclosures are one of the few places where a company publishes something against its own commercial interest. When a lab reports that its monitoring is fragile and trending the wrong way, that is more informative than any benchmark in the same announcement.

As with the AGI claim, none of this is independently reproduced. Everything here is the vendor's own report of its own model — worth taking seriously, and worth labelling.

Frontier labs publish frameworks that define capability levels with required safeguards attached. They are not marketing documents — they are commitments that constrain what the company may ship, and crossing a level triggers obligations rather than a press release.

That makes them one of the few places a lab publishes something against its own commercial interest, which is exactly why they repay careful reading.

A high benchmark score on offensive capability is expected as models improve. The genuinely new information is the admission that chain-of-thought monitoring is fragile and trending in the wrong direction.

Monitoring is what makes a capable model governable. A model that is more capable and harder to observe at the same time removes the mitigation exactly when the mitigation is most needed. That combination, not the ExploitBench number, is the part worth watching over the next few releases.

• ▸Patch cadence. The assumption that finding vulnerabilities is slow and expensive is weakening, which shortens the window between a flaw existing and being found.
• ▸Dependency hygiene. Automated discovery favours whoever looks hardest, and that is now cheap for both sides.
• ▸Disclosure timelines. Norms built around human-speed research may not survive machine-speed discovery.
• ▸Defensive tooling. The same capability improves scanning and triage, so this is not purely a bad-news story.

For local models specifically, nothing changes. Open-weight models at sizes you can run at home are nowhere near this capability level, and the gap is measured in orders of magnitude of parameters rather than in months.

Does this mean the model will be misused?

It means the capability exists and the lab says so. Access controls, refusal training and monitoring are what stand between capability and misuse, and the same disclosure says one of those three is weakening.

Should I worry about open-weight models doing this?

Not at current sizes. A model you can run on a consumer card is not close to this. The question becomes real if capability at this level ever appears in open weights, which it has not.

Is ExploitBench a good measure?

It is a benchmark, with the usual caveats — a score of 100% says the test has been saturated, which tells you as much about the test's remaining headroom as about the model.