OpenAI Just Called Its Zero-Day-Finding AI “Critical.” Defenders Should Too.

By Viral Trivedi, Director of Solution Engineering and Customer Success, Tuskira

On September 1, OpenAI disclosed that Astra is the first model to meet the “Critical” cybersecurity capability threshold under its Preparedness Framework. In OpenAI’s words, with the right tools and access, the model can find previously unknown security flaws and develop ways to exploit them without a person guiding each step. During evaluation it discovered and used two zero-day vulnerabilities as part of an exploit chain, which OpenAI is now disclosing to the maintainers.

The model itself is shipping. The advanced cybersecurity workflows are not, at least not broadly: those go first to a group of testers, with access expanding later through OpenAI’s Daybreak Blue program for defensive use, while the company builds out monitoring for cyber misuse and unauthorized model actions.

That is the part security leaders should sit with. A frontier lab assessed its own model, concluded it can find and exploit previously unknown vulnerabilities with limited human guidance, and slowed access because the operational controls had to catch up.

Why the gating matters more than the discovery

AI-assisted vulnerability research isn’t new. What’s new is a lab formally classifying its own system as having crossed an offensive threshold, in writing, under a framework built for exactly this moment. That’s a different signal than a research paper or a red-team demo. It’s OpenAI telling the market: this capability is real, it’s here now, and we don’t yet have monitoring mature enough to hand it out broadly.

Access-gating is a real safeguard today. It buys time. It is not, on its own, a plan for what happens when the next lab ships a model at or past this line, and one will.

What this does to mean-time-to-exploit

For roughly 25 years, the SOC’s job has effectively been to out-detect a human-paced adversary: find the intrusion, understand the blast radius, respond, faster than the attacker can act. That model assumes exploitation still runs on human timelines. Research, weaponization, deployment, each step taking days or weeks a defender can work inside of.

Astra breaks that assumption at the research and weaponization steps. If a frontier model can find an unknown vulnerability and build a working exploit for it faster than most security teams can patch a known one, mean-time-to-exploit compresses in a way patch cadence and manual triage were never built to match.

The backlog model breaks with it. “Critical but not yet exploited” stops being a comfort the moment exploitation itself runs at machine speed. That gap doesn’t close because one lab restricted access. It closes when defenders can see, continuously, which of their own exposures would actually be reachable and exploitable if a model like Astra came looking, and shrink that surface before the model has to be right even once.

What an Astra-class model does to a backlog

It’s tempting to picture this as a model hunting for a new zero-day in your stack. That’s the less likely version. The more likely version is a model that never needs one, because it reads the findings you already have the way an attacker does, as a graph rather than a list, and finds the three medium-severity items nobody fixed that happen to connect.

We walked exactly that chain this week in a fictional environment called Northwind Cloud. An API docs endpoint that answered without a login, an authorization check that only leaked one record at a time, and a cloud role scoped a little wider than the export feature needed. Each one had sat in the backlog for months, rated medium, defensible to defer. Chained together they took an anonymous connection from the public internet to the customer data lake in ninety seconds, with no credentials and nothing the WAF recognized as an attack. The full hop-by-hop walkthrough is here.

A human red teamer finds a chain like that in a day or two of careful work. Astra’s disclosure says a model can now do the equivalent without a person guiding each step. The three bugs didn’t get worse. The time it takes to connect them collapsed.

The takeaway

OpenAI’s disclosure is honest, and the restraint is the responsible call. But gating access to the model that can do this is a stopgap while the industry works out what “critical” means operationally, not a substitute for it.

The defensive answer is to run the same search before the model does. Not a periodic scan and a spreadsheet of theoretical CVEs, but continuous proof of which entry points actually reach which crown jewels, which controls actually stand in the way, and which single fix collapses the path. That is what Kairo builds and validates on a customer’s own stack, and it’s why the Northwind chain resolves to one engineering ticket instead of three. The organizations that will handle this well are the ones that already know which of their paths are exploitable today, without needing a frontier model to find out first.

See a real breach path on your stack →

Sources: Path to Astra: critical capabilities and frontier safeguards (OpenAI) · OpenAI to limit access to Astra’s most powerful cyber capabilities (Axios) · OpenAI’s Astra Crosses ‘Critical’ Cyber Threshold After Finding Zero-Days (SecurityWeek) · OpenAI Astra Brings Autonomous Zero-Day Exploitation to AI (Security Affairs)