GPT-6 Astra: Critical Cyber Rating, Daybreak Gate and Rollout

What 'Critical' actually triggers

OpenAI's own system card calls Astra the first model to reach the Critical level of cybersecurity capability under its Preparedness Framework, defined there as being able to find previously unknown security flaws and develop new exploits across many well-protected systems without a person guiding each step. [2]

The rating changes what happens before release, not just what ships. The system card describes tightened checkpoint encryption and access controls, monitoring of complete reasoning traces rather than only outputs, and alignment evaluations that block internal use of the model until they clear, alongside a restricted internal deployment window before the model was available to OpenAI's own coding agents. [2]

That is the substance of a Critical rating under the framework: at the lower High threshold, safeguards mainly have to reduce risk before external deployment; at Critical, the framework treats development itself as the exposure, since a capable-enough model would be dangerous if it leaked or was misused internally, regardless of what OpenAI later decided to ship. [2]

One model, two behaviors

Fortune reported that the version reaching most users is trained to refuse advanced cybersecurity tasks, while OpenAI's Daybreak program, aimed at vetted enterprise customers doing cybersecurity work, got access first. Daybreak sits inside OpenAI's broader vetted-access structure for capabilities it will not hand out by default. [4]

The system card's own description of the safeguards points the same way: it names trusted-access arrangements for cybersecurity researchers and actor-level enforcement alongside jailbreak-resistant classifiers, which describes gating and monitoring layered onto a single deployment rather than confirming two separately trained models. [2]

Fortune's framing of a model trained to refuse those requests suggests the general release carries its own refusal behavior baked in through training, not just a system prompt. Neither document lays out whether Daybreak customers run different weights or the same weights under a lifted restriction, so that mechanical detail is not independently confirmed here. [4][2]

Disclosure first, then a slow drip to everyone else

OpenAI said Astra had crossed the Critical cybersecurity threshold on September 1, 2026, two days before the model shipped to anyone. [3]

The September 3 release went first to a limited set of organizations, including Daybreak's cybersecurity customers, with Plus, Pro, Business and Enterprise access, the API, Azure and Amazon Bedrock following in the days after, according to OpenAI's announcement and Fortune's reporting of the same sequence. [1][4]

Brockman's AGI line is a claim, not a measurement

OpenAI president Greg Brockman told Fortune it is not unreasonable to feel that we are now in the AGI era, and that if a single model has to be named the first one, Astra is a reasonable choice. He also said he saw AGI as arriving gradually rather than in one identifiable moment, which sits uneasily with picking a single model as its start. [4]

That is Brockman's characterization of a model built by his own company, offered in the same interview where he described Astra's computer-use speed. Nothing in the system card claims an AGI threshold, and no independent body was cited making that determination, so the term stays attributed to him rather than treated as an assessment of the model. [4][2]