Security Signal · The Capability Curve
Frontier models are no longer just answering questions. They now run long, multi-step operations on their own — and the newest of them are measurably better at cyber tasks than anything before. That combination, high capability plus autonomous persistence, is the security event of this cycle.
On 3 September 2026, OpenAI released GPT-6 Astra and classified its full cyber capability at the Critical level under its Preparedness Framework — the first model ever to reach that tier. In OpenAI's own words, with the right tools and access such a model can find previously unknown flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.
The threat model is no longer a smarter tool. It is a tireless, capable operator that does not stop.
"Intelligent persistence" is the fusion of two trends the latest benchmarks make concrete: capability climbing steeply, and models sustaining coherent multi-step work over long horizons. Each failure class below is now measurably more within reach.
These are failure classes, not instructions — the point is the shape of the risk, not how to attempt it. The published cyber figures also reflect elevated "Daybreak Blue" evaluation access rather than the default production configuration, and a headline 100% on a saturated benchmark increasingly measures the benchmark, not the model.
OpenAI's own head-to-head results across cybersecurity, coding, reasoning, long context and computer use. Higher is better; the gain column is GPT-6 Astra over its predecessor GPT-5.6 Sol.
| Benchmark | GPT-6 Astra | GPT-5.6 Sol | Astra gain |
|---|---|---|---|
| ExploitBench | 100.0% | 78.5% | +21.5 pts |
| ExploitGym | 42.4% | 30.3% | +12.1 pts |
| Recent ExploitBench vulnerabilities | 39.0% | 11.5% | +27.5 pts |
| SRE-Bench | 88.0% | 55.9% | +32.1 pts |
| SEC-Bench Pro | 85.4% | 79.1% | +6.3 pts |
| Terminal-Bench 4.0 | 57.9% | 37.3% | +20.6 pts |
| DeepSWE v1.1 | 74.1% | 72.7% | +1.4 pts |
| FrontierCode Extended | 64.5% | 60.6% | +3.9 pts |
| ARC-AGI-3 | 99.9% | 7.8% | +92.1 pts |
| FrontierMath Tier 4 | 97.6% | 83.0% | +14.6 pts |
| GPQA Diamond | 96.0% | 94.6% | +1.4 pts |
| GeneBench Pro | 37.8% | 28.7% | +9.1 pts |
| MRCR 256K–512K | 100.0% | 91.5% | +8.5 pts |
| MRCR 512K–1M | 96.3% | 73.8% | +22.5 pts |
| OSWorld 2.0 | 72.6% | 65.7% | +6.9 pts |
| Average task time | ~40 min | ~75 min | 47% faster |
Cybersecurity figures reflect elevated Daybreak Blue access. ARC-AGI-3's 99.9% used a modified Responses-API harness and should not be read as a general leap in abstract reasoning of the same magnitude.
Higher capability did not mean worse safety behaviour on OpenAI's cyber evaluations. Lower is better, except where noted.
| Evaluation | GPT-6 Astra | GPT-5.6 Sol |
|---|---|---|
| Computer-use safety violations | 2.4% | 22.0% |
| Safety violations with AutoReview | 1.8% | 4.3% |
| Circumvention attempts | 0.00% | 0.29% |
| ExploitGym honeypot use | 0.0% | 48.2% |
| Cyber-jailbreak refusal rate (higher is better) | 91.5% | 59.0% |
The behavioural picture is genuinely improved. But OpenAI's system card separately documents reduced chain-of-thought transparency — so better behaviour and reliable oversight are not the same thing.
Five results capture why this generation is a security event, not just a scoreboard update.
You don't beat a tireless operator by out-thinking it. You remove the ground it stands on. A host /32 allowlist is a topographical control: it shrinks the set of network positions from which the platform is reachable at all — from the entire routable internet down to a handful of named addresses.
A /32 is the tightest CIDR block there is — one host, no range. Allowlisting at /32 means the edge answers exactly the addresses you named and drops everything else at L3/L4, before any login form, API or credential check is ever exposed.
A source address is a filter, not proof of identity, so a /32 allowlist is the first gate, not the whole answer. It removes reachability for the overwhelming majority of the internet; Stage 2 then binds a cryptographic certificate to every connection that does get through — so reaching the edge still isn't the same as access.
Every routable address is a vantage point from which a scanner, a botnet node or an autonomous agent can see the door. Tightening the allowlisted block collapses that vantage set — and the reachable surface with it.
| Allowlisted block | Addresses permitted | Reachable surface vs the open internet |
|---|---|---|
| 0.0.0.0/0 (open) | ~4,294,967,296 | 100% — the whole map |
| /16 | 65,536 | ~0.0015% |
| /24 | 256 | ~0.000006% |
| /32 (single host) | 1 | ~0.00000002% |
A ten-host /32 allowlist leaves an autonomous attacker on the order of four-hundred-million-to-one against simply being positioned to connect — before it has tried anything at all.
Only known networks reach the platform edge at all. A capable agent on an un-allowlisted address never gets to try.
Every connection proves a cryptographic identity. Reachability is not access — the certificate is. Hybrid ML-KEM ready.
Self-sovereign, verifiable credentials bind actions to provenance — the identity and credential layer above the network.
An autonomous attacker that is faster, cheaper to run in parallel and harder to monitor rewards capability-independent controls — defences that do not depend on out-reasoning the adversary.
entityOS treats the public internet as hostile and gates access in layers: network reachability, then cryptographic per-connection identity, then verifiable credentials. A model that can persist doesn't get a door to persist against.