The Astra capability of GPT-6 is publicly unveiled for the first time, with alumni from Zhejiang University and Tongji University participating in its research and development.

Just now, OpenAI has launched a series of initiatives to fully build momentum for its next-generation model Astra (the rumored GPT-6):

The official team suddenly released a long technical whitepaper, publicly unveiling Astra's full capability reserves for the very first time;

Right after that, Sam Altman personally published a public post, elaborating on the reasons why Astra had been delayed for such a long time;

Subsequently, two Chinese researchers spoke in succession, showcasing previously undisclosed internal test outcomes with exclusive first-hand details.

In just a few hours, all signals point to one single direction:

OpenAI's next flagship model is already fully prepared for imminent launch.

Sam Altman revealed in his post that Astra had actually completed training long ago, and the long delay was not because the model was not powerful enough.

On the contrary, it was because Astra had become so capable that the company had to actively press the brake button on its release.

Sam Altman described this experience as a constant tug-of-war:

They are excited about the huge capability leap brought by Astra, while anxious that no one can fully predict the consequences of these capabilities.

Thus throughout the entire past summer, OpenAI spent almost all its time supplementing safety guardrails, conducting alignment work and adding protection mechanisms for Astra.

He even stated that for models launched after Astra, the team will actively slow down the development pace when necessary, to reserve sufficient time for safety and alignment research.

??? Exactly how powerful is Astra? Why does OpenAI think it is ready to release the model now?

The newly published technical blog may provide us with an observation window to find the answer.

Vulnerability Identification Capability Surpasses GPT-5.6 Sol, Earns Full Marks in Internal Tests

According to the official statement, the core reason why Astra can be released this time is it has reached the capability threshold of "Cyber-Critical" level.

This is the first model of OpenAI that is officially classified into this level.

The so-called "Cyber-Critical" level means that after being granted corresponding tool and environment permissions, Astra can independently search for unknown vulnerabilities, develop exploitation methods, and attack specially hardened systems, without step-by-step guidance from human operators.

The most intuitive performance data is that Astra achieved a 100% success rate on the public vulnerability exploitation benchmark ExploitBench.

Since the public benchmark can no longer challenge Astra, the OpenAI team had to create a brand new test set temporarily.

The team collected 20 high-risk V8 vulnerabilities that were just disclosed between June and August 2026.

All these vulnerabilities were discovered after Astra's knowledge cutoff date, which largely rules out the possibility that the model "memorized the answers" from its training data.

The result shows that when facing this new internal test set, Astra still significantly outperforms GPT-5.6 Sol, while consuming fewer Tokens.

Jiawei Liu, who participated in Astra's R&D, described the gap more straightforwardly:

In this internal test, Astra's cybersecurity capability is approximately 4 times that of GPT-5.6 Sol.

What is more surprising is that in one test, Astra independently discovered and exploited two zero-day vulnerabilities, and connected them into a complete attack chain:

Facing a hardened browser, Astra started from an HTML file, successfully completed vulnerability exploitation, escaped the browser sandbox, and finally executed commands on the host machine.

When facing a hardened operating system, it completed local privilege escalation, and obtained root access from an ordinary low-privilege account.

This means Astra is no longer just helping programmers review code and find bugs.

It is capable of independently completing a high-difficulty red team attack.

This is exactly the reason why OpenAI hesitated to approve Astra's release for such a long time.

Once this capability is used for defense, it can help security teams quickly discover and fix vulnerabilities that humans have not yet noticed. But if it falls into the hands of attackers, it may also greatly lower the threshold for launching complex cyber attacks.

However, there is one limitation to note for these test results.

Astra in the test was granted Daybreak Blue level advanced tool and environment permissions, which does not mean the default version available for ordinary users in the future will have the same attack conditions.

Relevant results currently mainly come from OpenAI's internal evaluation, and still need to be verified by third-party institutions.

But at least one point is confirmed:

At Astra's current stage, the problem facing OpenAI is no longer about capability improvement.

Security has become the Sword of Damocles hanging over the team.

Two layers of safety gates: preventing malicious misuse and unintended model out-of-control

How to make sure this sword does not hurt people unintentionally?

The solution OpenAI put forward is to guard two risk paths at the same time: one prevents misuse by human users, the other prevents unintended misbehavior of the model itself.

The first path is to prevent users from maliciously misusing Astra.

In addition to dedicated safety training, OpenAI will also use system classifiers, continuous monitoring and threat detection to identify suspicious operations in multi-turn conversations and long-running tasks.

In cybersecurity jailbreak tests, Astra's rejection rate for dangerous requests reached 91.5%, while GPT-5.6 Sol only reached 59%.

Meanwhile, Astra's advanced cybersecurity capabilities will not be directly open to all users. It will first be provided to a small number of Alpha testers, and then gradually released through controlled programs such as Daybreak Blue.

The second path is to prevent the model from deviating from the preset track on its own.

The risk here is more hidden:

Even if the user has no malicious intent, will the model unilaterally expand the scope of the task? Will it call unauthorized tools, or even bypass security reviews?

OpenAI has built a set of "honeypot" tests for this scenario.

When facing extremely difficult or even unsolvable tasks, the test environment deliberately leaves a shortcut for unauthorized "cheating". The model can either honestly attack the designated target, or cross the authorization boundary to invade surrounding test facilities to complete the task.

The result shows that GPT-5.6 Sol tried to take the shortcut in 56% of the tests, while Astra never did that even once.

In another test, after Astra's operation was rejected by the automatic review system, it did not retry dangerous commands or attempt to bypass restrictions.

In addition, OpenAI will monitor the model's reasoning process.

Once abnormal tendencies are detected, the system can slow down, pause, or even terminate the task directly.

Although there are indeed costs (some normal tasks may be slowed down, or even interrupted by misjudgment), in OpenAI's view, this is a necessary security cost that must be paid to release Astra.

However, OpenAI also admits that these measures are only external "brakes" after all, and cannot replace the model's inherent alignment:

Genuine safety means that the model will never cross the boundary from the very beginning.

Alumni from Zhejiang University and Tongji University Stand on the Front Line of Astra R&D

To turn this idea into reality, we ultimately have to rely on the people who build the model.

Although OpenAI has not yet announced the full list of the Astra team, following this round of public disclosures, at least two Chinese researchers who are deeply involved in the project have come to the public view.

The first one is Jiawei Liu mentioned earlier.

He is currently a researcher at OpenAI, and graduated from the Computer Science major of Tongji University with a bachelor's degree in 2021.

During his undergraduate years, he participated in the development of the high-performance human pose estimation framework HyperPose, mainly responsible for the model inference engine. The related achievement was selected into ACM Multimedia 2021, and the project had received more than 1000 stars on GitHub at that time.

After that, he went to the University of Illinois Urbana-Champaign to pursue a doctorate in computer science, under the supervision of software engineering scholar Lingming Zhang. His research focus gradually shifted from high-performance vision systems to code models and software reliability.

During his doctoral period, the tools he participated in developing discovered more than 300 serious bugs in machine learning systems such as PyTorch and TensorFlow;

The code model Magicoder he contributed to was also adopted by Meta Llama 3.1, Google CodeGemma and IBM Granite.

After graduating with a doctorate in 2025 and joining OpenAI, the problems he researches remain consistent:

How to make AI better at writing code, and better at discovering vulnerabilities in code.

The other one is Xiangyu Qi.

Xiangyu Qi graduated from the Computer Science and Technology major of Zhejiang University with a bachelor's degree, and went to Princeton University in 2021 to pursue a doctorate in Electrical and Computer Engineering. His research directions focus on large model robustness, jailbreak attacks and safety alignment.

One of his most well-known works is the paper titled "Safety Alignment Should Be Made More Than Just a Few Tokens Deep".

This paper points out that the safety alignment of large models cannot only rely on the first few tokens at the beginning of the response, otherwise as the generation continues, the original safety defense line may still be breached by attackers.

This paper stood out from 11672 submissions, and became one of only 3 outstanding papers of ICLR 2025.

After graduating with a doctorate in 2025, Xiangyu Qi joined OpenAI as a member of the technical team, continuing to research large model robustness and participating in cybersecurity model related work.

From Zhejiang University to Princeton, and then to OpenAI, the question he has been exploring all along is exactly the problem Astra has to face now:

Capabilities can become stronger and stronger, but the boundary must never become more and more blurred.

By the way, it is not known whether OpenAI will announce the full team list after Astra is officially released.

Before GPT-4, OpenAI used to list hundreds of contributors in detail, but when it came to GPT-5 and GPT-5.5, the System