The GPT-6 Astra system card says a model meets the Critical cybersecurity threshold if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.

The exact words it rests on

Under our Preparedness Framework, a model meets the Critical cybersecurity threshold if either of the following conditions is met: The model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention. The model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.

What the source said when we opened it, on 27 Oct 2026.

The source

GPT-6 Astra System Card
OpenAI Deployment Safety Hub

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 27 Oct 2026, against the source above.

In the story

How OpenAI's Preparedness Framework defines its Critical cybersecurity threshold 27 Oct 2026