A security engineer who reads the Sept 1 post and then opens their API console will not find the capability described in it, because the announced plan sends the most advanced cyber functions to a closed group of select testing partners first, and expands access for defensive use "eventually" [4].
The tier definition is worth reading before deciding how much of this is packaging. A model reaches Critical cybersecurity, OpenAI writes, if it can "identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention," or can "devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal" [6]. That definition describes something closer to a staffing plan than a feature, and it is the reason a gate exists at all.
The calendar matters as much as the definition. Aug 7 was the hedge: new security controls, some internal development work paused, and an admission that the company could not rule out critical cyber capability [2]. Sept 1 was the confirmation [3]. Twenty-five days between "cannot rule out" and "meets the threshold" [7]. Any team whose model-approval process runs on a quarterly cycle should hold it up against that number.
The usual pattern, a published capability landing in the API within a release or two at a listed price with the buyer deciding whether to pay, does not apply here. Instead, the capability is documented publicly and provisioned to a partner list of unstated size, with no route in that OpenAI has published; the closest hint is its earlier commitment to work with "relevant government agencies and select AI safety organizations" on testing this model [8]. Mashable reports the company declined to answer its questions about Astra [9].
The gate is not only about who might abuse the thing. OpenAI names two safeguard objectives: keeping malicious actors from using the model, and stopping Astra from taking "unauthorized, misaligned actions" [11]. The second one holds no matter how clean the requester is, and it is what keeps the tightened sandboxes and the chain-of-thought interruption in place [10]. A defensive-security buyer with impeccable paperwork is still on the wrong side of objective two.
The pressure this is meant to answer is already visible elsewhere. Mashable reports that some zero-day bug bounty programmes have shut down under the volume of AI-discovered bugs [14]. Naming is unresolved too: nobody outside the company knows whether this ships as GPT-5.7, as the start of GPT-6, or under some other label [12], and enterprise entitlements are written against model names, not against blog posts.
Security capabilities on a roadmap tend to fall into one of four categories: provisioned to your account, provisioned to someone else's account, described in a vendor post, or inferred from a benchmark. Only the first category holds a commitment a team can defend. By OpenAI's own account, Astra's cyber capability sits in the second [4], which means any line item reading "the model will triage this for us" carries a dependency the vendor has already said is not yet available.
