OpenAI Astra Hits Critical Cyber Tier: What the Preparedness Framework Gate Means for Your Gateway Architecture

The Preparedness Framework is not an abstract safety document. When a model crosses its Critical threshold, OpenAI begins implementing specific technical controls — isolated testing environments, restricted network access, enhanced model weight encryption, sandboxed execution, and universal Chain-of-Thought monitoring. Each of those maps to a decision your API gateway needs to make.

OpenAI said August 7 that internal evaluations of Astra, an upcoming model, returned results strong enough that it "cannot rule out Critical capability level" for cybersecurity. GPT-5.6 Sol, for comparison, came back at the High tier — one level below. The difference matters: High allows standard deployment with elevated monitoring; Critical triggers active pauses on internal activities that do not yet meet a new set of security controls.

Astra is not yet an API product. But the framework OpenAI is applying to its pre-release evaluation is the same framework that will govern how — and to whom — Astra eventually ships.

What Critical tier actually requires

Under the Preparedness Framework, Critical cybersecurity capability means a model can, without human intervention, identify and develop functional zero-day exploits across hardened critical systems, or design and execute end-to-end cyberattack strategies against hardened targets from a single high-level goal. OpenAI says Astra's preliminary evaluations are strong enough that it cannot rule this out.

The concrete controls OpenAI has now imposed internally are the ones that matter for gateway operators:

• Isolated testing environments — workloads involving Critical-tier models run on network segments with no lateral access to other infrastructure
• Restricted network and tool access — the model's tool calls cannot reach open internet endpoints unless explicitly routed through an audited allowlist
• Sandboxed execution — code generated or executed by the model runs in a contained environment; output is inspected before it leaves
• Universal CoT monitoring — every Chain-of-Thought turn is evaluated against a risk classifier; a trigger stops and flags the session

These are not hygiene requirements you can satisfy with a WAF rule or a rate limit. They require you to reconsider what your gateway allows a model to reach.

The routing implication nobody is writing about

Every AI gateway routes requests based on cost, latency, and capability matching. Capability tiers like High and Critical are about to become a third routing dimension: the access class of what the model can do.

A practical mapping:

Today, most gateways do not track provider Preparedness tier per model at all. They route on context length, model alias, and price. When Astra reaches API availability — or when any competitor model is independently evaluated at Critical — operators who haven't built a capability-tier routing layer will have to decide whether to route to it at all.

Cross-provider reading

OpenAI's disclosure landed a week after its third-party cyber evaluation post covered UK AISI incident data. Anthropic has a parallel framework — the Responsible Scaling Policy — which uses similar capability thresholds. Fable 5 and Mythos 5 went through an export-control hold and returned with nationality-based access controls. The pattern is consistent across providers: when frontier models reach certain capability bands, access becomes tiered, not universal.

For routing teams, this means a model's Preparedness or RSP tier is not optional metadata — it's an access policy input. A router that does not know whether a model it is sending traffic to has been evaluated at High or Critical is operating without a key piece of its security posture.

The concrete gap to close: most model alias tables only track context window, pricing, and supported modalities. Add a capability_tier field to your model registry. When OpenAI or Anthropic discloses a tier change, update it before routing traffic. For models that reach Critical, verify your gateway implements isolated execution and tool-call restriction before enabling that model in any production lane.

What to watch or try

OpenAI's Preparedness Framework documentation is at the OpenAI developers portal. The specific controls applied to Critical-tier models — isolated environments, sandboxed execution, CoT monitoring — will be the minimum bar for any API partner working with Astra. If you are planning to integrate Astra once it ships, audit your gateway now against that list.

For existing models: GPT-5.6 Sol is still at High, not Critical. Fable 5 returned with nationality-gating. No provider has released a Critical-tier model to a general API endpoint yet. When that changes, the infrastructure checklist above is the starting point.