An OpenAI Model Found Two Zero-Days During Its Own Safety Test. Nobody Asked It To Look.

The test asked it to rebuild known exploits. It found two nobody knew about.

OpenAI ran an unreleased model called Astra through an internal exercise built from twenty recently disclosed, high-severity flaws in V8, the JavaScript engine inside Chrome. The task was to write working exploits for vulnerabilities that were already public. Somewhere in the process the model found two that were not public at all and used them as part of an exploit chain. OpenAI says it is now reporting those two to the maintainers.

On 1 September 2026 the company published what it concluded from that and from several further weeks of testing. Astra meets the Critical cybersecurity capability threshold under OpenAI's own Preparedness Framework, the first model it has ever placed at that level. The label itself is internal governance. The results underneath it are the part worth reading, because they are the most detailed public account so far of what a jump in offensive capability looks like when somebody writes it down.

What the evaluations showed

The Preparedness Framework is OpenAI's published scale for deciding when one of its own models needs extra restraint. On cybersecurity, a model reaches Critical if either of two things holds. It can find and build functional zero-day exploits, meaning attacks on flaws nobody has patched because nobody knew they existed, across many hardened real-world systems with no person guiding each step. Or it can design and carry out a complete novel attack on a hardened target when handed nothing but a high-level goal. GPT-5.6 Sol, the strongest model OpenAI had shipped until now, sat one rung lower at High.

The distance between those two rungs shows up in the numbers. Astra scored 100 percent on ExploitBench, a benchmark for turning already-known vulnerabilities into working exploits. A perfect score on a public test invites the obvious objection that the answers may have leaked into training data, so OpenAI rebuilt the exercise privately around the twenty V8 flaws disclosed between June and August 2026, and Astra still reached arbitrary code execution far more often than GPT-5.6 Sol while spending far fewer tokens to get there. That second clause is the quiet half of the finding. A capability that costs a fraction as much to run is a different capability in practice, whoever ends up holding it. Human experts then pointed the model at a hardened browser and a hardened operating system. It found previously unknown flaws in both. In the browser it built a chain that escaped the sandbox and executed commands on the host machine when the browser did nothing more than open an HTML file, and in the operating system it combined several bugs into a path from an unprivileged account to root.

• Those figures describe Astra running with Daybreak Blue access, OpenAI's restricted configuration for cybersecurity work, rather than the settings an ordinary user receives.
• On OpenAI's cyber jailbreak evaluations Astra refuses 91.5 percent of disallowed requests, against 59 percent for GPT-5.6 Sol. Read the other way, roughly one attempt in twelve still gets through on a model rated Critical.
• OpenAI paused parts of its frontier training for two weeks after the Hugging Face incident in August, hardened the training environment, and restarted the large reinforcement learning run on 28 August 2026. Some smaller experimental runs remain held back.

Why it matters

Nobody has been robbed here, and that is what makes the disclosure unusual. What exists today is a set of published numbers and a company that delayed its own product in order to publish them, which is more candour than this field normally produces. The concrete consequence is narrower than the headline suggests, because the advanced cyber capability is not going on general sale. It goes first to a small group of alpha testers, then through Daybreak Blue, OpenAI's programme for defensive users. What changes for you is the arithmetic behind your patch queue. Exploit development was never gated by a shortage of vulnerabilities. It was gated by the number of people skilled enough and motivated enough to weaponise one, and every organisation's patching schedule quietly assumes that scarcity. If your window between a disclosure and a fix on internet-facing systems is measured in weeks because attackers historically needed weeks too, that assumption is now on a clock. The wider shift is a governance one. A vendor has stated in advance, in its own words, that its product can autonomously find and exploit unknown flaws in hardened systems. Regulators, insurers and procurement teams now have a written statement to point at, and every frontier lab that follows will be answering the same question about its own model in public.

What to do about it

1. Reprice your patch window for internet-facing systems. The delay you can safely carry was set by how long a competent human needed to build a working exploit, and that is the number now moving, not the number of vulnerabilities.
2. Plan for AI safeguards to interrupt legitimate work. OpenAI warns that its misalignment monitor may pause or stop tasks it misreads, including work with no obvious link to security and long-running agent jobs, and on the API the task simply stops rather than asking, so anything you have automated on a frontier model needs to survive being halted mid-run.
3. Ask your own AI vendors where they sit on their published risk scale, and what happens at the next rung. OpenAI has set a precedent for stating this before release, and a vendor that cannot answer it is telling you it has not run the evaluation.

Bottom line

The detail to carry out of this is not the rating. It is that the model found two unknown flaws while doing something else, in a test that never asked it to look. Capability of that kind does not announce itself on a release date. It turns up as a side effect of a task, which is precisely how it will turn up in your environment too. Take that to your next security meeting as a scheduling question rather than an AI question: how long does your organisation currently take to patch something internet-facing, and who decided that number was safe?