OpenAI has disclosed that its upcoming artificial intelligence model, known as Astra, is capable of constructing cyberattacks without any human assistance. In an internal evaluation, the model became the first OpenAI system to reach the company’s “Critical” cybersecurity threshold, a classification reserved for AI that can discover previously unknown vulnerabilities and turn them into working exploits. The news has sent ripples through the security and cryptocurrency industries, where autonomous offensive AI is now viewed less as a theoretical concern and more as an imminent factor in how systems are attacked and defended.
OpenAI’s announcement describes a model that goes beyond helping human hackers write better phishing emails or analyze source code. Astra, according to the company, can operate independently across the entire attack chain: finding a vulnerability, crafting an exploit, deploying it and achieving a real security impact. That level of autonomy raises hard questions about the safety of releasing such powerful digital tools into a world already struggling with ransomware gangs, state-sponsored attackers and widely deployed vulnerable software.
Key facts about Astra
- OpenAI’s upcoming Astra model can autonomously discover previously unknown software flaws and turn them into working attacks, earning the company’s first “Critical” cyber capability rating.
- In OpenAI’s own testing, Astra exploited known vulnerabilities, found two new flaws, escaped a hardened browser sandbox and combined operating-system weaknesses to gain root access.
- OpenAI says it has delayed parts of Astra’s development to add safeguards, and it plans to restrict the model’s most advanced cybersecurity features to selected external testers.
- Security researchers are concerned that tools like Astra could rapidly exploit flaws in cryptocurrency software, adding risk to exchanges, wallets and smart contracts.
What makes Astra different
The “Critical” label is not a marketing phrase. OpenAI has a well-known internal preparedness framework designed to assess models that might pose dangerous capabilities. Cybersecurity is one of the key risk categories in that framework, along with other areas such as chemical or biological knowledge. On the cybersecurity scale, models are evaluated for whether they can complete offensive tasks with increasing autonomy and sophistication. Reaching the Critical tier means OpenAI believes Astra can handle high-complexity vulnerabilities in difficult environments with minimal supervision, which puts it in a different class from earlier language models and agent systems.
The practical implication is enormous. Many existing AI security assistants are trained to explain code, suggest possible mitigations or match known vulnerability patterns. Astra, by contrast, is described as a model that can reason through an unfamiliar system, identify its logical weaknesses and build a reliable attack. That is the kind of skill that expert penetration testers spend years learning. If such a capability is successfully contained, it could be used to find and fix critical flaws. If leaked, stolen or deliberately misused, it could give attackers a force multiplier unlike almost anything in the modern history of software security.
Security researchers who have followed the development of frontier AI say this was always considered a dangerous endpoint. In previous years, large language models struggled to execute long tasks or use computer tools consistently. Today’s agents can navigate websites, write files, run terminal commands and correct their own mistakes. Combining those abilities with offensive security knowledge points toward a future in which AI models act as their own attackers, operating far faster than human analysts and learning from every successful or failed attempt.
What Astra’s testing actually showed
OpenAI described controlled testing in which Astra was given a computing environment and asked to find weaknesses. In one set of tests, the model successfully exploited known vulnerabilities without requiring a human to guide each step. It also discovered two flaws that had not been previously known, a particularly striking outcome because unknown vulnerabilities, often called zero-days, are usually among the most expensive and carefully guarded secrets in cybersecurity. Finding a zero-day routinely takes elite human experts considerable time; an AI that can do so quickly suggests that the barrier to discovering new attack paths may soon be much lower.
Even more concerning to the testers was that Astra managed to escape from a hardened browser sandbox. Browser sandboxes are one of the most important defensive technologies on the modern internet, because they isolate untrusted code such as JavaScript on a webpage from the rest of a user’s computer. Escaping a sandbox typically means an attacker can read personal files, access system memory and interact with other processes running on the same device. Astra reportedly did this, and then in a separate chain of actions, it combined multiple weaknesses in the operating system to escalate its privileges all the way to root access. Root access gives a program complete and unfettered control over a machine, allowing an attacker to install persistent malware, disable security software and move laterally across a network.
The fact that Astra could combine separate vulnerabilities into a chained exploit is especially meaningful. Real-world cyberattacks rarely rely on only one weakness. Attack chains often require a first flaw to gain a small foothold, a second flaw to leap to a more powerful process and a third to reach critical data or privileges. Automating that multi-step reasoning has been a target for security researchers for years, but most automated tools remain heavily guided by humans and perform poorly outside known playbooks. If Astra can independently create such chains, it moves closer to the flexible, adaptive attack capability once imagined only for elite hacker teams.
Why OpenAI is slowing down
OpenAI said it has delayed parts of Astra’s development rollout while the company adds safeguards. In practice, this means the model will not be offered with its full range of cyber capabilities to every customer, at least at first. Instead, OpenAI intends to place the most advanced features behind stricter gates, granting access to selected vetted testers who are equipped to handle the dangers of live vulnerability discovery and exploitation. The company is also reviewing the model’s training procedures to reduce the chance that it can be prompted to carry out unauthorized attacks once deployed.
This decision reflects a broader tension inside the AI industry. Developers face enormous commercial pressure to ship products that can handle difficult, multi-step tasks. A model that can navigate a computer like a human is valuable precisely because it is autonomous. Yet cyber capability is a dual-use trait: the same talent that lets a model secure a system also lets it attack another system. By delaying and restriction the most dangerous capabilities, OpenAI is acknowledging that competitive speed cannot be the only factor determining release timing.
Some policy analysts view the announcement as an important precedent. OpenAI’s internal scale now says that a Critical cyber model is not a hypothetical future risk but a current operational reality. That could push other AI developers to adopt similar evaluations, and it could push governments to consider regulation around autonomous cyber offense. A model with this strength could potentially sit outside traditional vulnerability disclosure systems because it finds flaws not in a specific product but in general classes of software. No existing regulatory process can reliably manage that kind of distributed discovery and exploitation capability.
Critical implications for cryptocurrency
No part of the technology industry is watching OpenAI’s warning more closely than the cryptocurrency ecosystem. Digital asset businesses rely on code that moves value instantly and without intermediaries, and many platforms are under constant threat from attackers driven by the possibility of anonymous financial gain. If a model like Astra can find vulnerabilities and write working exploits in minutes, the risk to smart contracts, DeFi platforms and cross-chain bridges could rise dramatically.
The concern is not based on abstract fears. Decentralized finance has already lost billions of dollars in hacks that exploited small logic errors, flawed authorization checks or rushed upgrades. Many of those attacks were conducted by humans who spent days studying protocol code and transaction flows before striking. An autonomous AI model with Astra’s demonstrated skills could shorten that process to a matter of hours or even minutes. Every public contract becomes a more attractive target because the AI can rapidly scan for vulnerable patterns and immediately craft a transaction that drains funds.
Cryptocurrency software is an especially appealing target for advanced AI because so much of it is open source. Public code is easy for a model to analyze, and blockchains themselves provide a transparent ledger that reveals exactly where money is stored and how it moves. An attacker can search for misconfigured protocols, reward functions, exchange integrations or upgradeable contract patterns across hundreds of projects in a single attempt. Add instant liquidity and pseudonymous transfers, and the result is a security environment in which autonomous attacks could be both extremely fast and very difficult to reverse once launched.
The same tools that cause concern for crypto defenders could eventually be used for defense. AI models trained on vulnerability discovery might help auditors review smart contracts before deployment, locate reentrancy bugs, and verify that patches are effective. However, the current announcement makes clear that OpenAI is still wrestling with how to prevent the offensive side from outpacing the defensive side. Limiting Astra’s capabilities to trusted testers may slow the spread, but it does not eliminate the possibility that similar methods emerge from other labs or from malicious actors who obtain access.
Autonomous cyber capabilities are accelerating
OpenAI’s evaluation of Astra is part of a broader transformation in cyber tooling. Several years ago, AI models could only generate snippets of code or help attackers fine-tune phishing messages. Then came models that learned to operate browsers, launch command-line tools and automate penetration testing workflows. Today, frontier agents are expected to complete long chains of reasoning, test new ideas and revise their actions in real time. Cybersecurity has become a critical benchmark for this type of reasoning because successful attacks require planning, adaptation and deep knowledge of cause and effect.
Governments have also noticed. Several countries have warned that AI could reduce the skill barrier for offensive cyber operations, enabling smaller groups to carry out attacks once reserved for nation-states. At the same time, state-backed security agencies see autonomous AI as a way to discover vulnerabilities in critical infrastructure before enemies do. That dual-use reality makes the public release of any model with a Critical cyber rating an event with geopolitical consequences. OpenAI’s report on Astra may contribute to a future in which AI models are controlled under strict licenses, monitored through real-time usage limits and required to pass safety tests before entering the market.
The deeper question posed by Astra is how much trust the security community should place in the idea of an AI that can attack without human help. Even if OpenAI keeps the model in the hands of trusted testers, the underlying research advances the state of the art across the entire field. Other labs may develop similar models with fewer safeguards. The result could be a wave of automated vulnerability discovery that outpaces the human security workforce responsible for patching software, hardening networks and responding to incidents.
For now, OpenAI’s announcement stands as a clear signal that the era of purely assisted AI hacking is ending. Astra does not need a human to hold its hand while it locates a flaw, writes an exploit and breaks through layers of defense. The practical responses—delays, safeguards, restricted access—buy time but do not stop the technology from evolving. The real question is no longer whether AI can build attacks on its own, but whether defenders can adapt at an equally fast pace.
Source: Coindesk News