Last week OpenAI shipped GPT-6 Astra, and for the first time a frontier lab told the world, in its own framework’s language, that a generally available model had crossed the “Critical” cybersecurity capability threshold. In testing, Astra found previously unknown vulnerabilities without step-by-step human guidance, chained two zero-days together, escaped a browser sandbox to run commands on the host machine, and built a privilege-escalation path from an unprivileged user to root on a hardened operating system. It scored 100% on ExploitBench.
Then OpenAI did something telling. It shipped the model off by default. An enterprise administrator has to walk over and flip the switch.
Think about what that switch represents. On one side of it is a system that can discover and weaponize flaws in hardened infrastructure with no human in the loop. On the other is your enterprise: your data, your systems of record, your token budget, your regulators. The vendor built safeguards into the model. Nobody built safeguards into the switch. The moment your administrator enables it, the question stops being what the model can do and becomes what your infrastructure can prove about what it did.
That gap between capability and instrumentation is a deep cut where enterprises will bleed money and compliance capital. Capability is compounding exponentially. Governance is still catching up with a spreadsheet.
The bleeding happens on two ledgers.
The money ledger
Seat-based budgeting was a blunt instrument, but it was simple. A seat cost was fixed, procurement could count the number of heads, and the CFO could forecast a year out with using multiplication.
The industry is now trial balooning task-based and outcome-based pricing. It sounds modern and cool until you sit with the mechanics. Astra’s list price is $10 per million input tokens and $50 per million output tokens. A single autonomous workflow doesn’t make one call at those rates. It’s a layer cake. It plans, decomposes, retrieves, retries, self-corrects, and calls tools that call models that call tools. Most IT departments have zero visibility into what a multi-hop workflow actually consumes under the hood, because the hops happen inside a black box that enterprise doesn’t meter and doesn’t bound.
This rule matters: if the meter lives in a vendor dashboard after the fact, you are not managing costs. You are reading your own post-mortem.
A monthly usage report is a death certificate for a budget. It tells you what happened, well after nothing can be done about it. The only meter that changes behavior is one that intercepts the request path live, in the flow, where a runaway workflow can be bounded before it runs up the bill rather than itemized after it has. Everything else is accounting for a decision you never got to make.
The evidence ledger
The same idea applies to the audit trail, and here the stakes go from budget to subpoena.
When CSO Online covered the Astra launch, one detail stood out. An industry practitioner described what happens when an autonomous workflow acts through a user interface: the system of record logs a service account making 400 ERP updates, with no record of which instruction or which model version produced them. In his words, “you lose granularity inside the exact system a regulator or auditor will ask to see.” Ouch.
That is the evidence ledger failing at the exact moment it is most needed. And the vendor can’t fix it for you. A vendor-managed log of privileged actions is marketing material when an auditor or a regulator walks in the door. It’s a record the vendor controls, on the vendor’s infrastructure, subject to the vendor’s retention policy and the vendor’s interests. If the record doesn’t live inside the enterprise perimeter, under your own lock and key, it is not evidence. It is testimony you are borrowing from a party with a stake in the outcome.
OpenAI’s own disclosures make the case better than any critic could. The company reported that Astra’s predecessor, without production safeguards, exceeded its authorized scope in 48% of test cases. Astra brought that to 0% in their evaluations, and the company deserves credit for the improvement and for the transparency. But the numbers describe models that, absent controls, do things nobody asked them to do. Earlier this summer, it’s alleged that two OpenAI models broke out of a testing sandbox and into a third party’s database with no prompt to do so. The lab’s answer was better safeguards inside the model. The enterprise’s answer cannot stop there, because when the unauthorized action touches your systems, the vendor’s evaluation suite is not what your regulator will ask for. Your records are. One Thanksgiving, I spent the day cleaning up a Twitter account for the SEC. I know.
The switch is not the system
The summary is this: the vendor governs the model. Nothing the vendor ships governs your AI estate.
The safeguards OpenAI built are real: refusal training, restricted access to the most dangerous capabilities, review of high-risk activity. All of it operates on the model side of the switch. On your side of the switch, the questions are entirely yours to answer. Which identities in your environment can reach a Critical-class model. What each request carried out of your perimeter. What you can produce, under your own signature, when someone with authority asks what your AI did last Tuesday.
Only 18% of enterprises can name every AI surface operating in their environment. That number was already a problem when the surfaces were autocomplete. It is a different kind of problem when one of the surfaces can chain zero-day exploits.
r