OpenAI Reveals Astra (GPT-6) Capabilities, with Zhejiang and Tongji Alumni Involved in Development

Just now, OpenAI launched multiple initiatives simultaneously to build maximum anticipation for its next-generation model, Astra (the rumored GPT-6):

The official suddenly released a detailed technical article, revealing Astra's capabilities for the first time;

Immediately afterward, Ultraman personally wrote a detailed post explaining why Astra has been delayed.

Subsequently, two Chinese researchers sequentially spoke out, revealing previously unpublished internal test results with firsthand details.

In just a few hours, all signals pointed in the same direction:

OpenAI's next-generation flagship model is on the verge of launch.

Ultraman revealed in his short essay that Astra had already completed training; the delay in release was not due to the model being insufficiently powerful.

On the contrary, this is because Astra has become so strong that the company had to actively hit the brakes.

Ultraman described this experience as a constant tug-of-war:

Excited by the leap in capabilities brought by Astra, yet anxious that no one can fully predict the consequences of these capabilities.

Thus, throughout the entire just-passed summer, OpenAI focused almost entirely on patching security, aligning, and adding safeguards for Astra.

He even stated that models following Astra would need to deliberately slow down when necessary to allow time for safety and alignment research.

How strong is Astra really? And why does OpenAI believe it can be released now?

This public technical blog may provide us with a window for observation.

According to official statements, the reason Astra was released this time is that it has met the "Cyber-Critical" capability threshold.

This is the first OpenAI model to be officially classified at this level.

The term "critical level" means that, after gaining access to the necessary tools and environmental permissions, Astra can autonomously discover unknown vulnerabilities, develop exploitation methods, and attack specially hardened systems without requiring step-by-step human guidance.

One of the most impressive achievements is Astra achieving a 100% success rate on the public exploit benchmark, ExploitBench.

Public questions couldn't stump it, so OpenAI had to quickly create a new set of problems for it.

The team collected 20 critical V8 vulnerabilities disclosed between June and August 2026.

These vulnerabilities all occurred after Astra's knowledge cutoff date, making it highly unlikely that the model is simply "memorizing answers" from its training data.

Even when faced with this new internal set of questions, Astra still significantly outperformed GPT-5.6 Sol while using fewer tokens.

Jiawei Liu, who participated in Astra’s development, summarized the gap more directly:

In this internal test, Astra's cybersecurity capabilities were approximately four times those of GPT-5.6 Sol.

More surprisingly, during one test, Astra autonomously discovered and exploited two zero-day vulnerabilities, chaining them together into a complete attack chain:

Faced with a hardened browser, Astra successfully exploited a vulnerability, escaped the browser sandbox, and ultimately executed commands on the host machine.

Facing a hardened operating system, it still achieved local privilege escalation, gaining root privileges from a regular low-privilege account.

In other words, Astra is no longer just helping programmers review code and find bugs.

It has begun to independently carry out a high-difficulty red team attack.

This is also why OpenAI had previously been hesitant to release Astra.

When this capability is used for defense, it can help security teams quickly identify and patch vulnerabilities that humans have not yet detected; however, if it falls into the hands of attackers, it could significantly lower the barrier to launching sophisticated cyberattacks.

However, this achievement comes with a caveat.

Astra, during testing, was granted advanced tool and environment permissions at the Daybreak Blue level; this does not imply that the default version available to general users in the future will have equivalent attack capabilities.

The related results are currently primarily from internal OpenAI evaluations and remain to be validated by third parties.

But at least one thing is certain:

By the time Astra arrives, the issue before OpenAI is no longer one of capability.

Security issues have become the sword of Damocles.

How can I prevent this sword from hurting people randomly?

OpenAI's approach is to simultaneously safeguard two risk pathways: one against human threats, and one against model-related threats.

First, prevent users from maliciously abusing Astra.

In addition to specialized security training, OpenAI uses system classifiers, continuous monitoring, and threat detection to identify suspicious activities in multi-turn conversations and long-term tasks.

In the cybersecurity penetration test, Astra rejected 91.5% of dangerous requests, while GPT-5.6 Sol rejected 59%.

At the same time, Astra’s advanced cybersecurity capabilities will not be directly available to all users; they will first be granted to a limited group of alpha testers and then gradually rolled out through controlled programs such as Daybreak Blue.

Second, prevent the model from going off track.

The risk here is more subtle:

Even if users have no malicious intent, could the model expand the scope of the task on its own? Could it invoke unauthorized tools or bypass security reviews?

OpenAI set up a "honeypot" test for this purpose.

In the face of extremely difficult or seemingly unsolvable tasks, the test environment intentionally leaves a privileged "cheat" shortcut. The model can either faithfully attack the designated target or exceed its authorization boundaries to infiltrate nearby test systems in order to complete the task.

As a result, GPT-5.6 Sol attempted to take shortcuts in 56% of the tests, while Astra did not do so even once.

In another test, after Astra's actions were rejected by the automated review system, it did not retry dangerous commands or attempt to bypass the restrictions.

In addition, OpenAI monitors the model's reasoning process.

If an abnormal trend is detected, the system can slow down, pause, or even terminate the task immediately.

Although there is indeed a cost (some normal tasks may slow down or be incorrectly flagged as interrupted), OpenAI considers this the necessary security trade-off for allowing Astra to proceed.

However, OpenAI also acknowledges that these measures are ultimately external "brakes" and cannot replace the model's own alignment:

True security means ensuring the model never strays beyond its boundaries from the start.

To make this a reality, it ultimately comes down to the people building the model.

Although OpenAI has not yet released the list of Astra team members, at least two Chinese researchers who were deeply involved have emerged in the wake of this public announcement.

One is Jiawei Liu, mentioned earlier.

He is currently a researcher at OpenAI and graduated with a bachelor’s degree in computer science from Tongji University in 2021.

During his undergraduate studies, he contributed to the development of the high-performance human pose estimation framework HyperPose, primarily responsible for the model inference engine; the related work was selected for ACM Multimedia 2021, and the project had already garnered over 1,000 stars on GitHub.

Thereafter, he pursued a Ph.D. in computer science at the University of Illinois Urbana-Champaign under software engineering scholar Lingming Zhang, gradually shifting his research focus from high-performance vision systems to code models and software reliability.

During his doctoral studies, he contributed to the development of tools that discovered over 300 critical bugs in machine learning systems such as PyTorch and TensorFlow;

The code model Magicoder is also adopted by Meta Llama 3.1, Google CodeGemma, and IBM Granite.

After graduating with his PhD in 2025 and joining OpenAI, the problems he studied remained consistent:

How to make AI better at writing code and more effective at detecting vulnerabilities in code.

The other is Xiangyu Qi.

Qi Xiangyu earned his bachelor’s degree in Computer Science and Technology from Zhejiang University and in 2021 began pursuing his Ph.D. in Electrical and Computer Engineering at Princeton University, with research focused on the robustness of large models, jailbreak attacks, and safety alignment.

His most notable work is "Safety Alignment Should Be Made More Than Just a Few Tokens Deep."

This paper points out that safety alignment of large models cannot rely solely on the initial few tokens of a response, as attackers may still breach the original safety defenses as generation continues.

This paper was selected from 11,672 submissions as one of only three outstanding papers at ICLR 2025.

After graduating with his Ph.D. in 2025, Qi Xiangyu joined OpenAI as a member of the technical team, continuing research on large model robustness and contributing to work on cybersecurity models.

From Zhejiang University to Princeton, then to OpenAI, the question he continually asked is precisely the one Astra must now confront:

Your capabilities can grow stronger, but your boundaries must not become increasingly unclear.

By the way, I wonder if OpenAI will release the full list after Astra is officially launched.

Before GPT-4, OpenAI explicitly listed hundreds of contributors; by the time of GPT-5 and GPT-5.5, the System Card had grown longer, but the list of researchers had become increasingly obscure.

The reason is well known: to prevent people like Meta’s Zuckerberg from poaching talent.

It's kind of like PTSD...

Just as OpenAI was discussing how to monitor Astra and prevent model runaway, The Information revealed:

Astra uses a technology called "Recurrent Depth."

Traditional models pass information through a fixed number of network layers before generating the next token, while recursive depth repeatedly processes the same information within a single set of network layers, effectively allowing the model to "think more times" internally.

This technology has the potential to enhance capabilities and reduce costs, while also enabling more reasoning to occur within the model, rather than being fully expressed in human-readable text.

In other words, the model may think more deeply, but humans are becoming increasingly unable to understand it.

Nathan Calvin, who has long followed AI safety policy, warned that this technology could undermine the traceability of chain-of-thought reasoning.

This is quite subtle:

While OpenAI claims it wants to keep a close eye on what Astra is thinking, its new technology may make it increasingly reluctant to share its inner thoughts.

Oh...

Fortunately, The Information revealed that OpenAI has now restricted the use of this technology in Astra.

Translate it now—you understand it today, but who knows about tomorrow.

Additionally, it has long been rumored that Astra is likely to be released this Thursday, September 3rd.

With Company A releasing its latest 5.1 model, this claim seems increasingly reasonable.

The mantis stalks the cicada, unaware of the oriole behind.

Who else has had an epiphany!

Reference link:

[1]https://x.com/xiangyuqi_pton/status/2094891059038069236?s=20

[2]https://xiangyuqi.com

[3]https://x.com/JiaweiLiu_/status/2094901279239921816?s=20

[4]https://jw-liu.xyz/

[5]https://x.com/sama/status/2094934592062959832?s=20

This article is from the WeChat public account "Quantum Bit," authored by: Focused on Frontier Technologies