OpenAI Model Classified with Critical Security Capabilities After Discovering Two Zero-Day Vulnerabilities and Achieving Perfection in Penetration Testing

A security assessment report released by OpenAI revealed that the Astra model reportedly achieved a perfect score of 100% on ExploitBench, a benchmark designed to evaluate penetration testing capabilities, while the model discovered two previously unknown zero-day vulnerabilities.

Based on these results, the company classified the model in the category possessing "critical cybersecurity capabilities," a level that reflects the severity of potential misuse and obligates the company to implement additional controls, including restricted access and continuous monitoring measures.

This classification raises serious questions regarding the extent of control companies have over the AI models they develop, and how to balance making their exceptional research capabilities available while preventing their deployment in cyberattacks by malicious actors.

This incident is considered one of the clearest examples of what researchers call the "dual-use AI problem," as some estimate that models with advanced security capabilities can discover and patch vulnerabilities at the same speed with which they can exploit them.

What do these terms mean?

Zero-Day Vulnerability: A security flaw in software that has not yet been discovered by its developers, with no fix available — its name is derived from the "zero days" that have passed since its discovery, making it extremely dangerous because the attacker knows about it before the victim.