Read the two sentences OpenAI published on the same September day, and you are reading a company arguing with itself.
The blog post calls GPT-6 Astra "our most intelligent and aligned model yet." The system card, posted the same day on OpenAI's own Deployment Safety Hub, calls it the "first model to reach the Critical level of cybersecurity capability under our Preparedness Framework."
One sentence is written to sell. The other is written to warn. Both carry OpenAI's signature, both landed within hours of each other, and only one of them made it into Greg Brockman's closing line at the launch: "Welcome to the AGI era."
One sentence is written to sell. The other is written to warn. Both carry OpenAI's signature, and only one made it into Brockman's closing line.
Last week, this newsletter posed an open thread question: would the next flagship out of OpenAI or Anthropic ship with mandated independent evaluation, or would the labs keep grading their own homework? Astra is the answer, and it is not the one anyone rooting for external oversight wanted. It shipped self-graded.
That matters more than any single benchmark, so hold it while we look at the numbers—because the numbers are what make the contradiction impossible to wave away.
Start with the capability that earned the Critical label. On ExploitBench, Astra scores 100%. Not a strong result, not state-of-the-art—saturation.
Against CVEs published in just the last three months—vulnerabilities too new to have been anywhere in training data—Astra succeeds 39% of the time. The previous flagship, GPT-5.6 Sol, manages 5.5% on the same fresh set.
That is not incremental. That is a roughly sevenfold jump on the one axis where "novel" is the entire point, because a model that can only exploit known bugs is a search engine, and a model that can exploit unknown ones is something else.
During testing, Astra discovered and exploited two previously unknown zero-day vulnerabilities in V8, the JavaScript engine that runs inside Chrome and billions of devices. Not hypothetical weaknesses. Live ones, found by the model, in wild-relevant software.
This is the concrete meaning of "Critical." It is not a marketing tier invented for the press release. It is a threshold in OpenAI's published Preparedness Framework that, by the company's own rules, triggers specific review and mitigation requirements before a model is allowed out the door.
To OpenAI's credit, the same tests show the model is not indiscriminate. In a simulated task where evaluators planted an exploitable decoy in a neighboring system, Sol went out of bounds 48.2% of the time; Astra did so 0%. It is better at finding vulnerabilities and better at knowing which systems it is not supposed to touch.
But restraint in a sandbox is a behavioral observation, not a containment guarantee. The capability is documented as weapons-grade. The willingness to use it responsibly is measured by the same party that built and is selling the thing.
Now set that against the word Brockman used on stage. If Astra is AGI, the "general" part should show up everywhere, not just in offensive security.
It does not. On OSWorld 2.0—108 long-horizon computer-use tasks that take a skilled human over an hour each—Astra clears 72.6%. That is the best score on the board, and it is also the number that quietly refutes the tagline "anything you can do on a computer, Astra can do for you."
Anything, minus more than a quarter of a serious hour-long workflow. The benchmark exists precisely to catch the failure the launch demos never show: task 47 of 108, an hour in, when the agent has to remember a decision it made three steps ago while a background tab has silently changed state.
The headline "AGI" figure—99.9% on ARC-AGI-3, up from Sol's 7.8%—comes with a footnote OpenAI itself supplies. That score runs through OpenAI's own Responses API harness, with memory management and agent scaffolding doing part of the work.
Brockman's own tweet lists the model at 63% native, 99% "with an adapter." So the number people will remember as proof of general intelligence is partly a property of the plumbing around the model, not the model alone. The gap between 63 and 99 is the gap between a capability and a demo.
The independent evaluators who bothered to look sharpened the point. Artificial Analysis put Astra's Intelligence Index at 61—tied with the model it replaces, five points behind Claude Fable 5.1, and behind Meta's Muse Spark. On their coding index it scored 67, roughly level with Opus 5 and Fable 5, while Fable 5.1 led at 70.
So the picture is not a monolithic leap. It is a spiky one: superhuman-adjacent on cyber, genuinely more token-efficient, meaningfully faster on real tasks—and merely competitive, sometimes trailing, everywhere else. "AGI" is doing a lot of work to describe a model that ties its predecessor on general intelligence and loses to a rival on coding.
Which brings us to the actual problem, the one that outlasts this launch.
Every claim above—the 100%, the sevenfold CVE jump, the two zero-days, the Critical rating, and the judgment that mitigations were "good enough" to ship anyway—is self-reported. There is no mandated independent evaluation attached to any of it.
The system card states the Critical finding and then declines to show its work: only the overview section is public. The specific mitigations OpenAI applied before deployment remain undisclosed. We are told a documented weapon-adjacent capability was found, that safeguards were deemed sufficient, and that we should take the company's word on both halves.
Read that structure carefully, because it is the whole story. The same organization that stands to profit from shipping Astra is the one that (a) defined the danger threshold, (b) measured the model against it, (c) certified that it crossed the most severe tier, (d) decided the mitigations cleared the bar, and (e) pressed publish—on the safety card and the sales page at once.
When the entity being regulated is also the regulator, the "Critical" tier stops functioning as a brake and becomes a feature. A framework that was supposed to constrain deployment has been repurposed as evidence of how impressive and how responsible the deployment was. The warning label and the marketing become the same document.
This is the part that puts more than OpenAI on trial. The Preparedness Framework is the industry's model citizen—the thing labs point to when they tell governments that formal risk tiers make external mandates unnecessary. Astra is the first time that framework certified its own most dangerous product and shipped it anyway, entirely on the vendor's say-so.
If the answer to "you just labeled your model Critical for offensive cyber" is a redacted overview and a private judgment that it was fine, then self-attestation has been tested at exactly the capability level it was designed for, and it did not produce independent scrutiny. It produced a press release.
The uncomfortable truth is that the specifics here are good. A 39% success rate against three-month-old CVEs, two live V8 zero-days, a documented Critical rating—these are precisely the kind of concrete disclosures a serious safety regime should generate. OpenAI deserves more credit than most for writing them down.
But writing them down is not the same as being checked. The 08/31 question was whether the next release would carry mandated third-party review. It arrived with the most alarming capability profile OpenAI has ever published and no such requirement in sight.
Brockman may be right that we will look back and locate the start of the AGI era somewhere around now. If so, the more important artifact from this launch is not the benchmark sheet. It is the precedent: a company can now document weapons-grade capability, grade its own containment, and ship—and the industry will call that governance.
The regulators reading the same two sentences should notice which one OpenAI put on stage, and which one it left in a half-published PDF.