Quick answer
OpenAI’s Astra disclosure names stronger provider controls for a model that may approach the Critical cyber threshold. Teams evaluating any high-capability cyber model still need separate evaluator controls and application controls. One layer does not inherit authority from another.
Start with the Astra disclosure explainer to understand the preliminary status, then use the Astra readiness checker to test whether an evaluation plan has the minimum operating gates.
Three control layers
| Layer | Owner | Minimum evidence |
|---|---|---|
| Model provider | OpenAI | Capability evaluation, weight protection, release policy, platform monitoring, restricted access, external testing |
| Evaluating organization | Security and research leaders | Written authorization, isolated environment, approved targets, reviewer coverage, incident plan, audit trail |
| Application and agent | Builder and operator | Tool allowlists, network and filesystem boundaries, action approvals, rate and spend caps, logging, stop controls |
Do not collapse these layers. A sandbox does not grant target authorization. Trusted Access does not configure an application’s tools. An approved API project does not make every user, target, or action eligible.
Provider controls in the Astra announcement
OpenAI says it is using isolated testing environments, restricted network and tool access, stronger model-weight protections and encryption, additional monitoring and detection, and sandboxed execution. It also paused internal Astra work that did not meet the strengthened requirements and expanded testing with government agencies, safety organizations, and selected partners.
Those statements describe OpenAI’s response to a preliminary signal. They do not certify a third party’s environment or promise that the model will be released.
Evaluator controls before access
An evaluation plan should identify:
- the legal owner and written defensive authorization;
- exact targets, accounts, time window, methods, and prohibited actions;
- an isolated, disposable environment with no production secrets;
- restricted egress, destinations, tools, credentials, and data stores;
- named human reviewers for ambiguous or high-impact actions;
- universal logging of prompts, tool proposals, approvals, actions, outputs, and interrupts;
- objective stop conditions and an incident-response owner;
- retention, deletion, and evidence-handling requirements.
If authorization, isolation, review, or interruption is unavailable, the evaluation should fail closed.
Application controls for agentic workflows
OpenAI’s current API guidance says sensitive cybersecurity tool calls should be reviewed against approved scope before execution. Deny unauthorized actions, pause ambiguous or high-risk changes, maintain independent filesystem and network boundaries, keep audit logs, and fail closed when review is unavailable.
Implement the scope as code where possible: allowlisted targets and tools, short-lived credentials, bounded network paths, deterministic approval gates, rate and cost limits, and a kill switch independent of the model. Monitor actions and outcomes; do not rely on model reasoning traces as the only control.
Access and retention remain separate
OpenAI documents Trusted Access as a reviewed program. Approval is bounded to the approved person or service, workspace or API organization and project, model, and product surface. One access tier does not silently grant another, and Trusted Access does not automatically grant Zero Data Retention.
Verify the exact project’s model entitlement, endpoint, retention controls, and engagement terms. The Astra announcement does not establish any of them.
Frequently asked questions
Which controls did OpenAI name for Astra?
OpenAI named isolated testing, restricted network and tool access, stronger model-weight protection and encryption, monitoring and detection, sandboxed execution, activity pauses, and external evaluation support.
Do provider safeguards replace application controls?
No. The application still needs authorized scope, least-privilege tools, independent filesystem and network boundaries, approval for sensitive actions, audit logs, incident handling, and a fail-closed path.
Does Trusted Access authorize any cybersecurity target?
No. OpenAI documents access approval and engagement authorization as separate. Every target, action, account, tool, and environment must remain inside the approved defensive scope.
Official sources
- OpenAI: Astra cyber capability disclosure
- OpenAI Preparedness Framework
- OpenAI API cybersecurity checks
- OpenAI: Guardrails and human review
Source check: August 12, 2026. Recheck framework, access, retention, model, and tool-review requirements for the exact project.