OpenAI Designated Astra Critical; Anthropic Said Its Models Fall Short of Its Next Tier
On September 1, 2026, OpenAI designated its Astra model at the highest tier of its own cybersecurity risk scale, while Anthropic said its new models still fall short of the next tier on its own scale.
In September 2026, Anthropic and OpenAI each published a document about a new model, and neither mentions the other’s. Anthropic’s announcement opens on capability and precision: Claude Fable 5.1 and Claude Mythos 5.1 are “the same model, but with different levels of safeguards”, and the new safeguards flag fewer false positives than before. OpenAI’s document opens differently: with the statement that Astra meets the Critical cybersecurity capability threshold under its Preparedness Framework, the first model OpenAI has designated at that level.
Read side by side, the two documents are doing the same thing. Each company is placing a new model on its own risk scale and deciding who gets the version with the fewest restrictions. The difference is what each company says about where its own scale puts the result.
OpenAI Says Astra Meets Its Highest Cybersecurity Threshold
OpenAI’s document, titled “Path to Astra: critical capabilities and frontier safeguards”, states the designation plainly: “We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework, meaning that with the right tools and access, it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step. It is the first model we are designating at this level, and requires stronger safeguards during development and before release.” The “first” in that sentence is OpenAI’s own designation of its own model — the document does not claim an industry first.
OpenAI says its evaluation combined automated benchmarks with expert-driven assessments, and that “Astra represents a significant increase in cybersecurity capabilities compared to GPT‑5.6 Sol: it is both significantly more token efficient and more capable at vulnerability identification and exploit development.”
OpenAI also frames Astra’s release against the model’s own recent history. “Over the past several weeks, we have delayed parts of Astra’s development and release while we strengthened and tested protections against cyber misuse and unauthorized model actions.”
Astra’s Benchmark Results Carry a Permissions Caveat
OpenAI cites specific numbers to support the designation, each attached to a condition. On ExploitBench, “we ran Astra on ExploitBench where the model achieved a perfect score of 100% on the benchmark to evaluate the model’s ability to develop exploits from known vulnerabilities.”
Because of contamination concerns with that public benchmark, OpenAI built an internal set it calls “ExploitBench - Internal Port (June–August 2026)”, which contains 20 high-severity V8 vulnerabilities that were disclosed more recently. On that internal set, the model discovered and used two zero-day vulnerabilities as part of an exploit chain, which OpenAI says it is in the process of disclosing to the maintainers.
Every one of those numbers comes with a caveat that OpenAI states directly: “Astra results shown reflect capabilities with Daybreak Blue access, not the default production configuration.” On refusal behavior, OpenAI reports that “On our set of cyber jailbreak evaluations, Astra refuses 91.5% of requests (compared to 59% from GPT‑5.6 Sol).”
OpenAI also says testing found Astra more likely than GPT‑5.6 Sol to respect explicit safety and security restrictions and remain within its authorized scope, “making it our most aligned model to date”, and that it is deploying additional chain-of-thought monitoring in production.
For ordinary users, the tradeoff shows up as friction. If OpenAI’s misalignment monitor pauses a task, “users in ChatGPT or Codex may be asked to review the action before continuing. When using other surfaces like the API, the task will stop.”
Anthropic Reports Fewer False Positives
On safeguards, Anthropic reports two separate numbers that measure different things. One number is system-wide: “In cybersecurity, our newest safeguards block 60% fewer false positives than before.” For a narrower group, “Claude Code users can expect an average of around 60% fewer interventions per session from our cyber safeguards, relative to the previous safeguards on Fable 5.” Those are two different measurements — false positives blocked system-wide, and interventions per session for Claude Code users specifically — and Anthropic does not present them as a single figure.
Anthropic also expanded what Fable 5.1 is permitted to do: “Fable 5.1 can now be used to discover software vulnerabilities—though not to develop exploits for them.” Certain dual-use tasks still get redirected elsewhere: “Our safeguards do, however, still redirect several kinds of dual-use cybersecurity tasks (tasks that might have helpful or harmful applications) to our Opus models. This includes penetration testing, exploit generation, and binary-based vulnerability scanning.” Anthropic says it has not found evidence of a critical-severity jailbreak for Fable 5.1’s safeguards, matching the record it reports for Fable 5 and Opus 5. Fable 5.1 is generally available today, including on Amazon Web Services, Google Cloud, and Microsoft Azure.
Anthropic Says Mythos 5.1 Still Falls Short of Its Next Risk Tier
Anthropic’s own risk language is the sharpest asymmetry in the two documents. On chemical and biological weapons risk, Anthropic writes: “Mythos 5.1’s capabilities are greater than those of Mythos 5. However, our evaluations indicate that it still falls short of the next risk tier defined in our Responsible Scaling Policy.” On cyber risk, evaluated with cybersecurity safeguards turned off, Anthropic writes: “Overall, the model demonstrates the strongest cyber capabilities of any model we’ve released, though it still falls within the lower category of risk in our Frontier Compliance Framework.” Anthropic uses two different frameworks for the two risk areas — the Responsible Scaling Policy for chemical and biological risk, the Frontier Compliance Framework for cyber risk — and does not present either as crossed.
Two Trusted Access Programs, Each at a Different Stage
Mythos 5.1’s more permissive safeguards are not open to the public. Anthropic says Mythos 5.1 will be available through two trusted access programs. The Cyber Verification Program “currently provides access to certain Opus- and Sonnet-class models with reduced cyber safeguards for defensive security work. In the near future, this program will also include access to Claude Mythos-class models.” Mythos-class access through the CVP is not yet open.
The Life Sciences Verification Program is further along: it lets vetted life sciences professionals use Mythos 5.1 with research-oriented safeguards, and Anthropic says that, in partnership with the US government, it has enrolled participants.
Right now, Mythos 5.1 access “is only available to a set of US organizations”.
OpenAI’s access plan for Astra follows a similar two-stage shape. Its most advanced cybersecurity capabilities go, initially, to a small group of alpha testers, “with access through Daybreak Blue following to expand defensive use.”
The Same Structure, Different Scales
Table 1 sets the two documents against each other, axis by axis.
| Axis | Anthropic (September 2026 announcement) | OpenAI (Path to Astra, September 1) |
|---|---|---|
| Document leads with | Capability, then product items including fewer false positives | The Critical designation and the safeguards it requires |
| Risk self-assessment | Chem/bio: still below the next Responsible Scaling Policy tier. Cyber: still in the lower risk category of the Frontier Compliance Framework | Meets the Critical cybersecurity threshold under the Preparedness Framework — OpenAI’s own designation at that level |
| Two-configuration structure | Fable 5.1 (generally available) and Mythos 5.1 (trusted access only) — the same underlying model | Default production configuration and Daybreak Blue access — the same model, different permissions |
| Who gets the top tier | Cyber Verification Program (Mythos-class access announced but not yet open) and Life Sciences Verification Program (participants already enrolled) | A small group of alpha testers, then a wider group through Daybreak Blue |
| Rival model cited by both | GPT‑5.6 Sol, in benchmark comparisons | GPT‑5.6 Sol, in capability and refusal-rate comparisons |
The two documents describe a similar underlying structure: one model, two levels of safeguards, with access to the least-restricted configuration limited to selected or approved users and organizations. The asymmetry is in what each company says about its own scale — OpenAI says Astra crossed its highest threshold, while Anthropic says its models remain below their next one. “Below the next tier” on Anthropic’s scale does not mean safer than “Critical” on OpenAI’s. The two scales are different instruments, built on different frameworks with different definitions, and a result on one cannot be converted into a result on the other.
What Neither Document Answers
Neither document gives a calendar date for the next access step. OpenAI says Astra is coming “soon”, with advanced cybersecurity access opening in stages after that.
For more on how Anthropic has handled Fable-generation releases before, see the earlier comparison of Anthropic’s and AWS’s data-retention rules around Fable 5.
Sources
Primary
- Anthropic, “Introducing Claude Fable 5.1 and Claude Mythos 5.1”, https://www.anthropic.com/claude-fable-and-mythos-5-1
- OpenAI, “Path to Astra: critical capabilities and frontier safeguards”, https://openai.com/index/path-to-astra/
Anthropic’s announcement page is dated only “September 2026”; this article uses that month for its announcement and does not infer a day from the page.
Secondary
- CNBC (Ashley Capoot), September 1, 2026
- MacRumors (Juli Clover), September 1, 2026
This article summarises statements published by Anthropic and OpenAI in documents from September 2026. Capability and safety figures are the companies’ own reported results under their own test conditions.
Frequently asked questions
What does OpenAI’s Critical designation for Astra actually mean?
OpenAI’s Preparedness Framework treats a model as Critical if either of two conditions holds: it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or it can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high-level desired goal. OpenAI says Astra meets that threshold, calls it the first model the company has designated at this level, and is rolling out advanced cybersecurity access in stages: a small group of testers, then a wider group through Daybreak Blue.
Are Claude Fable 5.1 and Claude Mythos 5.1 different models?
Yes and no. Anthropic describes Fable 5.1 and Mythos 5.1 as the same underlying model with different levels of safeguards. Fable 5.1 is generally available; Mythos 5.1, whose safeguards are built for cybersecurity and life sciences work, is available only through Anthropic’s trusted access programs.
Did Anthropic’s new models cross a similar risk threshold?
Not by Anthropic’s own account. Anthropic says Mythos 5.1’s chemical and biological weapons capabilities are greater than its predecessor’s but still fall short of the next tier in its Responsible Scaling Policy, and that the model’s cyber capabilities, while the strongest Anthropic has released, still sit in the lower risk category of its Frontier Compliance Framework. Anthropic’s and OpenAI’s risk scales are built differently, so a result on one cannot be converted into a result on the other.