What a lab's 'critical' cyber threshold actually changes for you

In September 2026, OpenAI said its Astra model was the first to meet the “critical” cybersecurity threshold in its own safety framework. It scored a perfect result on ExploitBench, an evaluation of hacking capability against known system vulnerabilities, and in a modified version of that test it discovered and exploited two zero-day vulnerabilities without human guidance [2]. The coverage treated this as a line being crossed. For a one-person business or a five-person shop, that framing is useless, because it does not tell you whether anything on your own laptop needs to change this month.

Something does, but not for the reason the headline suggests. No lab announcement makes you the target of autonomous zero-day research; that capability gets pointed at systems worth the electricity. What the announcement confirms is a direction that already has a product page and a price list, and it should send you to look at the one place where an offensive-capable model sits genuinely close to your data: the coding agent you have already given file access, shell access and network access to. This guide is for people who run their own tools and approve their own permissions. If you have a security team, a vulnerability management programme and a SOC, you have better sources than this.

”Critical” is a defined term, not a superlative

When a lab says a model reached “critical” capability, it is not reaching for an adjective. OpenAI’s Preparedness Framework tracks three capability areas, biological and chemical, cybersecurity, and AI self-improvement, and grades each against two written thresholds. High capability means “capabilities that significantly increase existing risk vectors for severe harm.” Critical capability means “capabilities that present a meaningful risk of a qualitatively new threat vector for severe harm with no ready precedent” [1].

For cybersecurity the framework spells the Critical bar out. A tool-augmented model meets it if it can “identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention,” or if it can “devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal” [1]. That is not “helps a security researcher go faster.” That is original offensive research, start to finish, from a stated goal.

The consequence written into the same document is the part most coverage skipped. Systems that reach High capability “must have safeguards that sufficiently minimize the associated risk of severe harm before they are deployed” [1]. At Critical, the text says: “Until we have specified safeguards and security controls standards that would meet a Critical standard, halt further development” [1]. So the notable event is not that a model got good at exploitation. It is that a lab reached a line its own document told it to stop at, judged the stopping condition satisfied, and shipped. Worth holding lightly: every Astra number above is OpenAI’s own, and the reporting notes there is no third-party confirmation of it [2].

The transferable habit is small. When a vendor tells you a model is safe, ask which written threshold it was measured against, and what that document says happens when the threshold is met. If the answer is not a link to a dated, versioned file, you have been handed marketing.

The capability shows up on a price list before it shows up in a threat report

In April 2025, “a model that finds zero-days” was a written threshold in a safety framework [1]. Today it is a line on a price list. OpenAI’s public API pricing page includes gpt-5.6-cyber, a cyber-specific model, at $12.50 per million input tokens and $75 per million output tokens, short context only [3]. GPT-6 Astra itself is listed at $5 per million input tokens and $25 per million output on the short-context tier, and $10 and $37.50 on the long-context tier [3]. OpenAI has also said access to Astra’s most advanced cybersecurity capabilities will be more limited than general access [2].

The defensive side moved on the same track. OpenAI announced Aardvark on 30 October 2025 as “an agentic security researcher powered by GPT-5” that builds a threat model of a repository, inspects commit-level changes against it, tries to trigger each finding “in an isolated, sandboxed environment to confirm its exploitability,” and then integrates with Codex to propose a patch; in benchmark testing on “golden” repositories it “identified 92% of known and synthetically-introduced vulnerabilities” [4]. On 6 March 2026 that product was renamed Codex Security and released as a research preview to ChatGPT Enterprise, Business and Edu customers [4].

That is the durable shift, and it is the one you can act on. Capability that used to be a research claim is now a line item you can budget for, and the defensive version of it reached ordinary business customers about 4 months after it was announced [4]. It also means the same class of capability is cheap for people who never asked a vendor’s permission. Both halves are true at once, and only one of them is under your control.

What reaches a small business is volume, not a zero-day

The UK’s National Cyber Security Centre assessed in January 2024 that “AI will almost certainly increase the volume and heighten the impact of cyber attacks over the next two years,” and that “AI lowers the barrier for novice cyber criminals, hackers-for-hire and hacktivists to carry out effective access and information gathering operations” [8]. That is the mechanism that touches you. Not novel exploitation of hardened systems, but ordinary attacks produced faster, in better English, at higher volume, by people who could not previously produce them at all.

The clearest published illustration of the ratio comes from Anthropic. In a campaign detected in mid-September 2025, roughly 30 organisations were targeted, including large technology companies, financial institutions, chemical manufacturers and government agencies. Anthropic assessed with high confidence that a Chinese state-sponsored group was responsible, and reported that AI performed 80 to 90 per cent of the campaign, “with human intervention required only sporadically (perhaps 4-6 critical decision points per hacking campaign),” making “thousands of requests, often multiple per second” [5].

You are not on that target list. Read the numbers as an efficiency figure instead. One operator, 4 to 6 decisions, thousands of requests per second. Whatever fraction of that efficiency leaks into commodity phishing and credential stuffing is what changes your odds, and it changes them by making the cheap attacks cheaper rather than by making a new attack possible. Anthropic’s own recommendation to defenders points the same way: use the models on the defensive side, for security operations centre automation, threat detection, vulnerability assessment and incident response [5].

The offensive-capable model closest to your data is the one you invited in

OWASP’s 2025 Top 10 for LLM Applications lists Prompt Injection as LLM01 and Excessive Agency as LLM06 [7]. Those two in combination describe your actual exposure precisely. An agent reads a web page, a README, a dependency’s changelog or an issue comment; that text contains instructions; the agent has a shell, your credentials and a network connection. Nobody needed a Critical-threshold model for that to go wrong.

The defences are documented and mostly off by default until you set them. Claude Code’s security documentation is a fair template for what to look for in any agent you run. In Manual mode it starts read-only and can only write to the folder it was started in and that folder’s subfolders, and cannot modify files in parent directories without explicit permission [6]. Its sandboxed bash tool provides filesystem and network isolation, configured with /sandbox [6]. Commands that fetch content from the web, such as curl and wget, “are not auto-approved by default” [6]. Web fetch “uses a separate context window to avoid injecting potentially malicious prompts” [6]. First-time codebases and new MCP servers require trust verification, though that verification “is disabled when running non-interactively with the -p flag” [6].

Two details in that documentation deserve more attention than they get. If you start the agent directly in your home directory, trust acceptance is held for the current session only and is not written to disk, so the prompt reappears on each launch; the documentation tells you to start from a project subdirectory instead, where trust acceptance is saved per directory [6]. And on connectors, Anthropic states plainly that it “reviews connectors against its listing criteria before adding them to the Anthropic Directory, but does not security-audit or manage any MCP server” [6]. Every MCP server you add is a piece of software you chose to trust, on your own judgement, with the agent’s permissions.

Three documents tell you whether a vendor is worth trusting

The first is the capability framework. It should name the risk categories, state thresholds in testable language rather than adjectives, say what the lab does when a threshold is met, and carry a version and a date. OpenAI’s is a worked example you can read in 20 minutes, and it is specific enough that you can check a later announcement against it [1].

The second is the access terms. A vendor that has built something genuinely dangerous should be able to tell you who gets the sharp version and on what conditions. OpenAI limiting access to Astra’s most advanced cyber capabilities [2], and shipping Codex Security first as a research preview to Enterprise, Business and Edu customers rather than to everyone [4], are the shape of an answer. “Available to all users today” is also an answer, and a different one.

The third is the product’s own security page, and it is the one that matters most for daily work, because it describes defaults rather than intentions. What can the agent write to without asking. What runs without approval. What happens to fetched web content. Whether connectors are audited. Claude Code’s page answers all four in plain language, including the part where it says that no system is completely immune to all attacks [6]. A product page that only lists certifications and never lists defaults has not answered the question.

What still goes wrong

The reporting this guide starts from is thin in a specific way. Every figure attached to Astra came from OpenAI’s own evaluation, and the reporting states that without third-party confirmation it is difficult to evaluate the company’s claims about safety or preparedness [2]. Treat the perfect benchmark score and the two zero-days as a vendor’s claim about a vendor’s model, which is what they are. That does not make them false. It makes them unverified, and the difference matters when you are deciding how much weight to put on a threshold announcement.

The frameworks are self-graded and self-enforced. OpenAI’s own text says to halt further development until safeguards meeting a Critical standard have been specified, and the same organisation decides when that condition is satisfied [1]. There is no external referee here, no filing, no auditor signing off. When you use a capability framework as a buying signal, you are measuring whether a vendor writes down what it intends to do and can be held to its own words later. That is worth something. It is not an assurance.

Finally, the controls in this guide protect against accidents and against moderate prompt injection. They do not protect against an agent you deliberately handed production credentials to, and they do not protect against a connector you installed without reading. Anthropic says so directly in its own documentation: the protections significantly reduce risk, and no system is completely immune to all attacks [6]. If your work involves regulated data, client systems you do not own, or anything where a bad afternoon becomes a breach notification, this guide is a floor and you need a professional above it.