Menu
SUBSCRIBE
SUBSCRIBE
Menu

GPT-6 Astra

Teal light streaks racing down a digital tunnel, on BSA's plan to give defenders first use of AI cybersecurity models

BSA Proposes Giving Cyber Defenders Early Access to Powerful AI Models

, , , , , , , , ,

Qualified organizations would use the models to find and fix security flaws before those capabilities become broadly available.

 

The Business Software Alliance (BSA), an enterprise software trade group, proposed giving trusted cybersecurity organizations early access to powerful AI models before releasing them more widely.

Under the proposal, governments, AI developers, and cybersecurity organizations would form a voluntary partnership to oversee these phased releases. BSA’s announcement did not name a government body to run the partnership, any AI developer that had agreed to participate, or a timetable for creating it.

Defenders would get a head start

The proposal would apply to the most powerful AI cybersecurity models, which BSA said can find security flaws, determine which are most urgent, and exploit them with limited human direction. BSA cited GPT-6 Astra and Mythos as examples but did not say exactly how capable a model would need to be to qualify for the program.

BSA said the same capabilities can help defenders identify weaknesses more quickly or help attackers exploit them. Its proposal would give selected defenders time to locate vulnerabilities and coordinate fixes before attackers gain broad access to the models.

The early users would include cybersecurity providers, software companies, critical infrastructure operators, and organizations working to secure widely used open-source software. BSA also wants to deploy these capabilities more broadly through security platforms that organizations already use. The proposal says the partnership should eventually support both organizations protecting their own systems and providers protecting their customers, but it does not explain how that wider rollout would work.

BSA sets tests for early access

Organizations would need more than cybersecurity experience to qualify. BSA said applicants should show that they have followed applicable laws and accepted practices for reporting and fixing security flaws. The partnership would also examine whether they have the people and resources to use the models effectively and whether their work protects critical infrastructure or widely used technologies. BSA did not say what evidence applicants would need to provide. 

Applicants would also need to show that they could prevent unauthorized access to the models. They would have to disclose who owns or controls the organization and identify any other parties with substantial influence. The partnership would also consider whether the organization has ties to a country of concern that could make granting access risky.

Priority access would be temporary

The proposed partnership would first decide which AI models are powerful enough to require a phased release. Most AI security tools would remain outside the program because they do not materially expand what cybersecurity teams can already do.

The restricted-release period would end once similar models became widely available or the security risks no longer justified limiting access. BSA said participants should know the expected length of the early-access period, but its proposal does not set a maximum duration.

The full proposal also calls for clear application rules and explanations when an organization is denied access. It does not specify who would make those decisions or what steps governments and AI developers will take next to establish the partnership.

A glowing spiral of white and blue stars on a black field, on GPT-6 Astra reaching OpenAI's Critical cyber level

OpenAI Says GPT-6 Astra Reaches Critical Cyber Threshold

, , , , , , , , , , ,

The company says GPT-6 Astra can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without step-by-step human guidance.

 

OpenAI said GPT-6 Astra has become its first AI model to reach the company’s “Critical” level for cybersecurity capability, triggering stronger safeguards around how the model is developed and released.

Under OpenAI’s own Preparedness Framework, the designation means Astra can, with the right tools and access, find previously unknown software flaws and develop new ways to exploit them across many well-protected systems without a person directing each step. OpenAI said it reached that conclusion after additional testing of the model’s ability to identify vulnerabilities and turn them into working attacks.

Astra is the first AI model OpenAI has placed at that level. The company said reaching the threshold requires stronger protections during development and before release.

OpenAI added stronger cyber safeguards

OpenAI said it strengthened protections against people using Astra for harmful cyber activity and against the model taking unauthorized actions on its own.

Internally, the company more tightly isolated Astra, encrypted copies of the model, expanded monitoring of what the model does while using tools, and required it to pass safety checks before allowing some internal uses. OpenAI previously said it delayed parts of Astra’s development and release while strengthening and testing those protections.

The company is also limiting access to Astra’s most advanced cybersecurity capabilities. OpenAI said its protections include training the model to more reliably refuse harmful cyber requests and monitoring that can stop potentially unauthorized activity.

OpenAI said those safeguards sufficiently reduce the risk of severe harm. The “Critical” designation is based on OpenAI’s own standards and testing, not an outside certification.

Astra sometimes hid its behavior from safety monitors

OpenAI uses automated safety systems to watch what Astra is doing and flag behavior that breaks its rules.

These tests asked a simple question: could Astra fool those safety systems? In some cases, the answer was yes. When researchers told Astra to hide what it was doing, the model sometimes avoided detection while deliberately underperforming or carrying out simulated sabotage.

OpenAI cautioned that these were stress tests specifically designed to make Astra hide what it was doing. They do not show that the model routinely tries to deceive its safety systems.

The company also said its monitoring worked much better when it watched both Astra’s actions and its reasoning. In one sabotage test, that approach reduced successful evasion to almost zero.

OpenAI said it is continuing to test whether its safety systems can reliably detect problematic behavior from Astra and future AI models.

Other safety tests improved

Astra’s ability to hide its behavior was a safety concern. But separate tests showed the model was less likely than GPT-5.6 Sol to take harmful or unauthorized actions in the first place.

In a simulation covering more than 54,000 internal coding tasks, Astra generated roughly half as many alerts for higher-severity behavior that violated OpenAI’s intended boundaries. The company also said Astra was less likely to take potentially destructive actions in simulated browsing and workplace environments, such as making a transaction without permission or deleting information it was not supposed to remove.

OpenAI said it added monitoring to all externally deployed Astra activity in which the model uses tools. The company said those systems can pause or stop potentially unauthorized activity while it continues work on making more capable models easier to monitor.