Read the two ExploitBench numbers as failure rates. GPT-5.6 Sol missed 21.5% of the tasks, about one in five. Astra missed none [16]. The benchmark scores the step between an advisory and working code, turning known software flaws into exploits [3], so what matters to a patch queue is less the score than what the score was measured against.
The announcement does not say. Task count, target software, an evaluation run by anyone other than OpenAI, a jailbreak success rate, any observed misuse: none of it appears, and every capability figure is the company's own reporting [19].
The zero-day claims sit apart from the benchmark. OpenAI says Astra reaches substantially higher arbitrary code-execution rates than Sol against flaws it dates as the previous three months, July to August 2026, and that the set included two zero-days in software it does not name [6]. July to August is two months [18]. Small, but it is the only description offered of how fresh the tested bugs were.
The brake is server-side, and it has a date on it. OpenAI says less restrictive safeguards arrive through Daybreak in the coming weeks, opening up vulnerability and proof-of-concept validation, malware analysis, and detection engineering [9]. The company frames the whole release around what it calls a defender's window, a narrowing opportunity to close gaps before attackers seize them [15]. It also says it strengthened the model against jailbreaks, gave its monitoring systems more context, and added safeguards to detect and contain misalignment [11].
For the rest of the stack, the numbers that travel are FrontierMath Tier 4 at 98% and ARC-AGI-3 at 99.9% [5]. Those are the ones a procurement deck will quote. ExploitBench is the one a vulnerability manager should read, because a perfect score on advisory-to-exploit conversion is a statement about tempo, and tempo is what remediation SLAs are actually built on.
On OpenAI's own account the weights crossed the Critical cybersecurity threshold in its Preparedness Framework before the model shipped [2]. The restraint that came with them is configuration, applied per request, and scheduled by the vendor to relax. Anyone whose patch windows assume public exploit code trails an advisory by days should test that assumption against the tier OpenAI has promised for the coming weeks rather than the one available on launch day.
