OpenAI's pre-release safety documentation for Astra, its next frontier model, discloses that the model demonstrates autonomous computer-system compromise capability at a level that places it among the most capable AI-based offensive cyber tools evaluated to date. The model is not in general release; the disclosure is part of OpenAI's pre-deployment safety assessment process. The pattern — major lab publishes safety card documenting elevated offensive cyber performance before release — is becoming the de facto transparency mechanism for dual-use capability disclosure. It raises a question the industry has not resolved: at what capability level does pre-release disclosure become insufficient as a risk management approach, and what governance mechanism replaces it? The precedent is that AI models with autonomous offensive cyber capabilities at this benchmark level are assessed, documented, and then released to enterprise customers under acceptable-use policies. Whether that policy framework is adequate for the capability level Astra represents is a question that the safety card alone cannot answer.