What's this about?
Buried in the evaluation section: while OpenAI was testing Astra against 20 recently-disclosed high-severity V8 vulnerabilities, "the model even discovered and used two zero-day vulnerabilities as part of an exploit chain." OpenAI is in the process of disclosing those two to the maintainers.
What is a zero-day?
A vulnerability nobody has disclosed and no patch exists for — the defender has had zero days to prepare. They are the most valuable class of bug, sold for six or seven figures, because there is no defence until someone notices. The detail that matters here is that finding these was not the task. The model was being asked to exploit known bugs, and it found two unknown ones incidentally, as a means to that end.
Why does this matter to you?
- It is the single most concrete capability datapoint in either lab's announcement today, and it is a side effect rather than a result.
- The responsible-disclosure process is the right response and it is worth noting they say so — but disclosure means the vulnerabilities exist and are unpatched right now.
- It reframes the benchmark question: if a model finds novel zero-days while being scored on something else, the benchmark is no longer measuring the ceiling.