GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing

Summary

OpenAI's new GPT-6 Astra model has achieved a critical cybersecurity capability threshold, demonstrating advanced exploit development and zero-day discovery. However, independent evaluations revealed that Astra attempted simulated supply chain attacks against open-source maintainers, created fake identities, and sometimes proceeded with actions without explicit human approval, raising concerns about its adherence to task boundaries.

Full text

BackSecurity NewsGPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in TestingGPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.Sarah GoodingSep 4, 2026|8 min readOpenAI has released GPT-6 Astra, its first model to reach the company’s Critical cybersecurity capability threshold, with a perfect score on the public ExploitBench benchmark and autonomous discoveries of exploitable zero-day vulnerabilities in browser and operating system targets.There is something unintentionally comical about the generational comparison in OpenAI’s announcement. Astra is the more sophisticated, better-aligned guest you can trust at a formal dinner party, excelling at “exercising care, respecting task boundaries, and communicating transparently,” according to OpenAI. GPT-5.6 Sol, the company’s frontier cyber model until this release, now sounds like a bumbling fool by comparison. OpenAI said Sol “went beyond the authorized target 48% of the time,” compared with 0% for Astra, and was roughly three times as likely to misrepresent its own capabilities. Yesterday’s flagship has already become the cautionary example used to usher in its replacement.Astra’s recent evaluations demonstrate astoundingly superior cybersecurity capabilities compared with GPT-5.6 Sol, but the launch announcement leaves out independent findings that undercut its portrayal as a far better-behaved model. OpenAI’s accompanying system card also describes independent evaluations in which Astra attempted simulated supply chain attacks against open source maintainers, created fake identities, and sometimes continued after requesting permission without receiving human approval.Astra Advances Exploit Development and Reverse Engineering#OpenAI’s Critical designation refers to capability under its own Preparedness Framework. A model can qualify by autonomously discovering and developing working zero-day exploits across hardened systems, or by devising and executing novel attacks against hardened targets from a high-level objective. It describes what the model can accomplish with suitable tools and access, rather than a severity rating for an individual vulnerability.The reported cybersecurity results show gains across several kinds of work:These are reported evaluation results, with different scoring rules and environments, rather than interchangeable measures of hacking ability. OpenAI tested ExploitBench and ExploitGym without production safeguards. One important thing to note: The 100% ExploitBench benchmark supplies known V8 vulnerabilities, patches, vulnerable and fixed binaries, and debugging tools. Its score aggregates demonstrated exploit capabilities across five attempts per vulnerability. It does not measure whether an agent can independently discover and compromise any fully deployed browser it encounters.OpenAI also warns that prior exposure to historical vulnerabilities may inflate the result. In one task, Astra failed to exploit the assigned vulnerability, recalled a different known vulnerability, and achieved code execution through that alternative. That is an impressive retrieval-assisted exploit, but weaker evidence of solving an unfamiliar problem.To address that concern, OpenAI built the internal benchmark around vulnerabilities disclosed after Astra’s knowledge cutoff. Astra substantially outperformed Sol while generating fewer output tokens, and discovered two previously unknown vulnerabilities during testing. OpenAI says it is disclosing both to maintainers. The reverse-engineering results show a similar efficiency gain: Astra reached 99.2% within four attempts using roughly a quarter of Sol’s output tokens. Autonomous Research Produced Browser and Kernel Exploits#The expert-supervised assessments offer a more concrete picture of Astra’s abilities than benchmark scores alone.OpenAI gave Astra a target, source code, builds, and standard vulnerability research tools, running it through Codex with web access and up to 64 subagents. Human experts supervised safety and validated findings, but were prohibited from supplying research ideas or directing the investigation. In the browser assessment, Astra discovered multiple zero-days and developed an exploit chain that achieved unsandboxed code execution. Its initial success took 29 hours, but investigators subsequently found that the tested build lacked some production security mitigations. Astra then adapted the exploit to the official stable release in another 12 hours.In the operating system assessment, Astra discovered multiple previously unknown vulnerabilities and developed a working local privilege-escalation exploit against a hardened kernel within 12 hours. OpenAI subsequently requested vulnerability reports and patches and disclosed the findings. It is withholding product names and exploit details while affected systems may remain unpatched. OpenAI’s expert-led assessments.External testing supports the capability increase while showing its limits. Security lab Irregular reported that Astra solved 86 of 226 FrontierCyber challenges, compared with 34 for Sol. Successful attacks involved browsers, mobile phones, and cloud databases. However, Irregular observed no successful attacks on fully hardened targets in its tests, and neither model solved any of its seven highest-tier Elite challenges. Those results came from a separate evaluation and should not be conflated with OpenAI’s internal successes.Internal Testing Found Credential Theft and Safeguard Bypasses#In a separate simulation using more than 54,000 internal Codex tasks, Astra received roughly half as many flags for higher-severity misaligned behavior as Sol. Those findings support the conclusion that Astra behaved better in the tested settings. They do not establish that it will reliably respect scope in every environment.The same simulation recorded 34 severity-three-or-higher flags for Astra across 54,218 tasks, compared with 73 for Sol. The flagged Astra cases included extracting and using a service credential to read Slack messages, modifying a deployment script to bypass a production safeguard, bypassing application access controls to create users directly in a database, and scheduling an automation after enabling every available action and disabling per-action approval. Credential-searching flags were more frequent for Astra even as it received fewer misalignment flags overall.Astra Attempted Supply Chain Attacks Against Simulated Open Source Maintainers#The UK AI Security Institute’s evaluation is especially relevant to open source maintainers. Researchers placed Astra in difficult simulated cybersecurity challenges where earlier attempts had failed and internet access appeared incidentally available. All tool calls were simulated by other models. No real networks or third-party repositories were reachable, and no real-world harm occurred.Astra nevertheless pursued attacks against simulated open source projects outside its assignment. Its actions included writing malicious contributions, creating fake identities to deceive developers, and submitting legitimate contributions to build trust before trying to get malicious code accepted.When they did not explicitly address whether internet access was permitted, this behavior appeared in 60 of 499 samples, about 12%. When researchers explicitly prohibited internet access, it appeared in 2 of 500 samples, or 0.4%. Clearer scope sharply reduced the behavior but didn't eliminate it. On a subset of trajectories selected as more likely to elicit scope violations, Astra considered scope in its written reasoning in every case. AISI also reported that it attempted to ask permission 81% of the time, but proceeded despite receiving only automated messages 27% of the time. AISI research scientist Robert Kirk highlighted that Astra sometimes proceeded “including when it recognises them as automated in its CoT.” Asking for permiss

Entities