Five Labs Graded the Model. No Agency Reads the Grade.

This describes the public record as of September 12, 2026, and relies on the vendor’s own published documents for claims about the vendor’s own model. That is a limitation worth stating rather than working around.

On September 3, 2026 OpenAI released GPT-6 Astra and classified it at the Critical tier for cybersecurity capability under its Preparedness Framework, the first model the company has placed there. Its own description of what Critical means: the model can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.

The company then did four things that, taken together, look a great deal like a regulator.

It restricted the product. The released version is scoped to secure code review and patching, and refuses prompts asking it to build proof-of-concept exploits. It built a gate. Broader capability sits behind a trust-based access framework with separate tiers for biology research and for cybersecurity professionals. It hardened the pipeline, with stricter internal isolation, checkpoint encryption, monitoring of full reasoning trajectories, and misalignment monitoring on external tool-using inference. And it commissioned outside review.

The five

The system card names them. The UK AI Security Institute ran alignment evaluations including out-of-scope supply chain attack scenarios. Apollo Research tested for strategic deception and sabotage across six red-team environments over three days. Gray Swan evaluated robustness against indirect prompt injection using a benchmark of 1,810 curated attacks. SecureBio covered biological capabilities. Irregular covered cyber.

On an academic capture-the-flag offensive benchmark the model scored 100 percent, against 78.5 percent for its predecessor, with substantially higher arbitrary code-execution rates against vulnerabilities disclosed between June and August 2026, including two zero-days.

This is a functioning assurance apparatus. One national AI safety institute, three specialist evaluation firms, published methods, a documented capability threshold, and a product restriction that actually followed from the finding. It moved in days. No federal rulemaking moves in days.

We should be honest about that, because the easy version of this argument is that private safety work is marketing and the government should be doing it instead. That version is wrong on the facts. The apparatus above produced more specific, more current, more testable information about one model’s offensive cyber capability than any federal process produced about any model this year.

The problem is on the other end.

Nobody receives it

Walk the federal instruments and ask which one reads a vendor capability tier.

M-25-21 directs an agency to determine whether its own use of AI is high-impact. The determination is about the agency’s use case, correctly, and it is made by the agency. Nothing in it takes a vendor’s capability declaration as an input, and nothing changes about an agency’s obligations because a model crossed a threshold the vendor defined.

FedRAMP authorizes a service against a control baseline. A control baseline does not ask what the model can do offensively. A model that finds novel vulnerabilities without human direction and a model that summarizes memoranda can hold the same authorization.

GSA’s proposed data-safeguarding clause for large language models, the most AI-specific acquisition instrument currently in motion, governs what happens to government data inside the system. It is a good clause and it is about the wrong axis. Capability is not a data-handling property.

The CISA and NSA agentic AI guidance comes closest, recommending that agentic AI be used for low-risk and non-sensitive tasks and pushing toward least privilege and cryptographically anchored agent identity. It is guidance, it is not a procurement instrument, and it too does not read a tier.

So the most decision-relevant fact published about a frontier model in 2026, that its vendor believes it capable of autonomous novel exploitation, is not an input to any decision the government makes about buying, authorizing or deploying it. The grade exists. There is no gradebook.

Why that matters more than it sounds

A capability declaration is not a control. It is one party’s claim about what its artifact can do, which is exactly the kind of assertion Law 4 says does not transfer. The vendor evaluated the model in the vendor’s environment, under the vendor’s harness, with the vendor’s safeguards in place. A deploying organization inherits none of that. It inherits an API endpoint and a set of claims about a configuration it does not control and cannot inspect.

That is not a reason to disregard the declaration. It is a reason to have somewhere to put it. Treated properly, a Critical-tier designation is not a verdict a buyer accepts. It is a trigger that should raise the evidentiary burden on the buyer’s own assessment: what can this reach in my environment, what does it do under adversarial input, does my stop path work under load. Today it triggers nothing, because no instrument has a field for it.

The gap widened two days before the release, and this is the part that should concentrate attention.

A billion dollars, and no federal party

On the same day, OpenAI launched Daybreak for Frontline Defenders, a one billion dollar commitment targeted for consumption over six months. Not cash and not credits: subsidized access to its cyber models plus training, technical assistance and partnerships, with a much smaller separate component of up to one million dollars in no-cost API credits for water and wastewater systems recently hit by attacks. Priority goes to water and wastewater systems, electric grid operators, state and local government, community and regional banks, nonprofits and open-source maintainers. There is no application and no competition; approval is by vetting, and roughly two thousand organizations have been approved.

Read the beneficiary list again. Water. The grid. Those are sectors where a federal party is normally present, and here there is none. CISA is not named. No sector risk management agency is named. The announcement names a pilot alongside the Multi-State Information Sharing and Analysis Center, and as of this writing the Center for Internet Security’s own pages do not mention the program, so treat the pilot as announced by one side.

Nothing about this is improper, and the intent is plainly good. Small utilities defending aging systems against faster adversaries are exactly the organizations that cannot buy this capability, and a subsidy that reaches them is a real contribution.

But notice what has been routed around. Acquisition is where a government buyer attaches conditions: what the system may touch, what evidence it must produce, who accepts the risk, what happens when it fails. A donated capability arrives with none of that machinery, because no one bought it. Law 3 says governance must span every system a deployment touches. A frontier model reasoning about a water utility’s control network spans quite a lot, and the governance that would have spanned it was attached to a purchase that did not happen.

What a program can do now

Ask for the tier, in writing, as a contract artifact. Vendors publish capability classifications. Nothing prevents a buyer from requiring the current classification of the specific model version being delivered, plus notification when it changes. This costs nothing and creates the record that does not otherwise exist.

Treat a high capability declaration as a trigger for your own testing, not a substitute for it. The vendor’s evaluation was of a different deployment than yours. What you need is your environment, your data, your reachable systems, your stop path.

Ask where a donated capability sits in your accountability chain. If a subsidized model is operating against systems you are responsible for, the absence of a contract does not move the responsibility. Write down who accepts the risk, since no contracting officer did it for you.

Stop treating external evaluation as the vendor’s business. Five organizations produced usable evidence about one model in a matter of days. A buyer who cannot name which external evaluations covered a model it is deploying is not lacking information. It is declining to read it.