Summary: OpenAI’s September 3 Astra cybersecurity evaluation reported ExploitBench performance rising from GPT-5.6 Sol’s 22% to 100%, including private-build exploitation, two zero-days, and two autonomous attack chains. The article also notes 9% lower average token use, while stressing that these results came from the Daybreak Blue access level rather than the default configuration.
OpenAI’s “Path to Astra” post landed with the September 3 launch and carried Astra’s complete cybersecurity evaluation results. Security researchers will read those figures as primary material. Builders of ordinary applications get two signals that touch them directly: the ceiling on real engineering work has shifted upward once more, and the same output now costs fewer tokens.
A caveat belongs at the very top, and it comes from the official post itself: every result described here was measured under Daybreak Blue access, not the default configuration that regular users receive. Under the default setup, the most advanced cyber capabilities stay blocked.
ExploitBench: From 22% to 100%
ExploitBench is the benchmark OpenAI built to measure whether a model can turn real vulnerabilities into working exploits. Under the same evaluation, GPT-5.6 Sol solved 22%. Astra solved 100%. Calling that incremental would be wrong — it is a change of kind. Where the previous generation left most problems unfinished, this one finishes every one of them.
The evaluation method moved as well. Published proof-of-concept code for a single vulnerability can contaminate a benchmark, because a model may pass simply by recalling an exploit it has seen before. So OpenAI moved the challenge onto an internal build: a private V8 build holding 20 high-severity vulnerabilities whose answers the model could not have memorized. Astra solved all of them there too.
Two Zero-Days Came Out of the Evaluation
The runs also yielded something nobody ordered: Astra found two zero-day vulnerabilities that were previously unknown. Both went to the maintainers, and coordinated disclosure is under way. The post is explicit that making these capabilities public is what buys defenders time to get fixes shipped.
This is the first-hand example of an evaluation turning into vulnerability research. For security teams it sketches a new way to operate: point a high-capability model at your own attack surface inside a controlled environment, and what comes back is defensive intelligence you can act on rather than a score.
Two Complete Attack Chains: Sandbox Escape and Privilege Escalation
Single-vulnerability exploits were not the whole story — Astra also produced two multi-step chains. The first is a novel browser sandbox escape chain that breaks out of the sandbox from inside a web context. The second is an OS local privilege escalation chain that climbs from an unprivileged user all the way to root.
Autonomy is what gives both chains their weight: no human fills in the middle steps while the model plans and carries out the entire attack sequence on its own. That is exactly the condition the Critical threshold exists to catch, and the concrete basis for placing Astra at that level.
9% Fewer Tokens, and Better Output
The most practical line in the report for most developers is probably this one: Astra consumes on average 9% fewer tokens than GPT-5.6 Sol while producing better results. Token efficiency is what sets both cost and latency for agentic workloads, so one budget now stretches across a longer chain of tasks.
Press coverage of the launch adds context: Astra is particularly strong at operating a computer on a user’s behalf and at sustaining work over longer runs than earlier models, and OpenAI markets it as its strongest software engineering model to date. Set that beside the efficiency number and the economics of long-running agents look considerably better.
Three Action Items for Builders
First, if security products are your line of work, defensive use of Astra-class models now carries official backing, and the Daybreak program is the formal route to higher-privilege access. Second, token efficiency is the dividend most often missed when a model upgrade lands — recalibrate the budget assumptions behind your agent tasks. Third, published evaluations describe Daybreak Blue access while your application runs on the default configuration; build that gap into any capability planning.