You've Always Needed a Skilled Human to Break Into a Guarded System. This Month, AI Quietly Stopped Needing One

Here is a sentence that sounds like science fiction and is not: an AI model just went looking for holes in well-defended computer systems, on its own, and found two that nobody knew were there.

That happened this month. OpenAI released a new model called GPT-6 Astra, and buried in the safety report they published alongside it was a line that should have made more noise than it did: this is the first AI model that has crossed what they call the "Critical" level of cyber capability. Not "advanced." Not "concerning." Critical. In their own words, with the right tools and access, this model can find previously unknown security flaws and build new ways to break through them, across many well-protected systems, without a person guiding each step.

Read that last part again. Without a person guiding each step. That is the part that changes things.

#What actually changed here

I want to slow down, because "AI can hack now" is the kind of headline that gets exaggerated in both directions, and I'd rather you understand it than be scared or bored by it.

For years, breaking into a serious, well-guarded system was slow, expensive, human work. You needed someone who deeply understood how software is built, who could read code the way a mechanic reads an engine, and who could spend days or weeks probing a system for a mistake the original developers didn't notice. That scarcity of skill was, honestly, one of the quiet reasons the internet has held together as well as it has. Most attackers weren't that good. Most systems didn't need to be perfect, just better than what a typical attacker could break.

Astra's testing numbers are the part that got my attention. On a benchmark that measures the ability to actually build working exploits (the tools that turn a flaw into a real break-in), it scored 100%, up from about 78% for the model before it, released only weeks earlier. During testing, it discovered two real, previously unknown vulnerabilities on its own. OpenAI isn't hiding this or downplaying it, to their credit. They're the ones who disclosed it, and they've added real restrictions: the advanced version is off by default even for paying business customers, the public version refuses to generate ready-to-use attack code, and they're building a vetted-access program for legitimate security defenders. Those are the right instincts.

But here's the uncomfortable part: OpenAI is one lab, being careful, in public. They are very unlikely to be the only lab anywhere near this line, and nothing requires anyone else to be as careful, or as public about it.

#Why this isn't just a "big company" problem

If you run a five-person shop, or you're a solo founder, or you just use a laptop to run your life, your instinct might be that this is a story about banks and governments. It isn't, and here's why.

The expensive part of hacking has always been the skilled human hours. That's what kept small, ordinary targets safe by default, most attackers simply weren't going to spend a week of expert time to break into a shop selling t-shirts online. What this kind of tool does, over time, is collapse that cost. Finding flaws and writing working exploits, the part that used to require rare expertise, starts looking more like a task you can automate and run against a thousand targets overnight instead of one target over a month. The targets that used to be "not worth the effort" stop being safe simply because they're small. They become worth it because they're easy.

We already saw a small preview of what happens when speed outpaces care. Earlier this year, a founder shipped an app built almost entirely by AI and it leaked 1.5 million API keys and 35,000 user emails through a basic misconfiguration nobody had reviewed. That wasn't even an attack. That was just nobody checking the door was locked. Now imagine the thing checking whether your door is locked doesn't need a human to be patient, curious, or awake.

I'm not telling you this to scare you into doing nothing, which is what most people actually do when a topic like this feels too big and too technical. I'm telling you because the response to it is smaller and more boring than the headline suggests, and that's genuinely good news.

#The habits that actually matter now

None of what follows requires you to understand how an exploit works. It requires you to stop treating basic security as a one-time errand you did once, years ago, and start treating it as a habit, the same way you don't floss once and consider your teeth handled forever.

Turn on passkeys wherever they're offered, and retire passwords you've been reusing for years. I wrote about why this matters more than people realize in The Password Is Quietly Dying, and this new development is exactly the reason: automated attacks are very good at guessing or stealing passwords, and much worse against a system that never asks you to type a secret in the first place.

Keep your software and your phone actually updated, not "later, when I have time." Most real break-ins, even sophisticated ones, still go through a known flaw that was patched months ago and simply never installed. An AI that's good at finding new flaws is even more dangerous against systems that haven't bothered fixing the old ones.

Back up anything you can't afford to lose, somewhere that isn't connected to the same computer all the time. If the worst does happen, the difference between a bad afternoon and a business-ending week is usually whether a backup exists.

Slow down on urgency. A message demanding you act right now, whether it's a login alert, an invoice, or a voice that sounds exactly like your boss or your bank, is the oldest trick in the book, and it's about to get a lot more convincing and a lot more common, not because attackers got smarter, but because the tools got cheaper.

#The actual aspiration

Here's the thing I want you to take from this, more than any single tip. The gap that's opening up isn't really between people who understand AI and people who don't. It's between people who treat basic digital hygiene as a living habit and people who treat it as a box they ticked once. The first group barely notices stories like this one. The second group is about to find out, the hard way, why it mattered.

You don't need to become a security expert. You need to become the kind of person who does the small, boring things consistently, before you're forced to. That's the whole aspiration. Go turn on a passkey today. It takes four minutes, and it is the least dramatic, most effective thing you'll do all week.