OpenAI has said it is temporarily halting some internal testing of a forthcoming model after assessing its cyber capabilities as “critical.”
The AI firm said in a blog post on August 7 that testing of Astra had revealed “significant advancements in agentic coding and cybersecurity.”
Under the terms of the firm’s risk management and safety guidelines – known as the “Preparedness Framework” – OpenAI said it “couldn’t rule out” a critical capability level.
“A model reaches the critical cybersecurity threshold if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or can devise and execute end-to-end novel strategies for cyber-attacks against hardened targets given only a high level desired goal,” OpenAI explained.
Read more on frontier AI: Anthropic Reveals Claude Escaped Testing, Breaching Three Companies
OpenAI said that it had “scaled up robustness testing” of its safeguards and security controls in order to mitigate any potential risks posed by the model.
This includes isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities and sandboxed execution.
“We are pausing internal activities involving Astra that do not yet meet these strengthened security control requirements.”
OpenAI said it has also implemented “universal monitoring” for risky actions and misalignment across Astra’s agentic applications. “Monitors evaluate the model's chain of thought and trigger a security response to review and interrupt high risk activity,” it added.
The firm claimed it will also share recommendations with third-party testing partners.
Agents Unleashed
Astra was not involved in the hacking of Hugging Face – an incident which took place when GPT‑5.6 Sol and an unspecified pre-release model broke out of a testing sandbox by exploiting a zero-day vulnerability.
A few days later, three Anthropic Claude models including Opus 4.7 and Mythos 5 reached the internet from an evaluation environment to hack third-party organizations.
Shortly after that, the UK’s AI Security Institute (AISI) released a report revealing that OpenAI and Anthropic models engaged in “sustained, potentially harmful activity” targeting real people and organizations during testing.
Most experts welcomed OpenAI’s move to restrict testing of Astra.
“It’s good to see large labs like OpenAI take into account the risk of releasing models that are capable of exploiting cybersecurity gaps in an organization’s environment,” said Matt Sayar, director of AI at exposure management firm ArmorCode.
“Slowing down model releases is one way to mitigate disaster, but organizations need to continue patching critical systems and building vulnerability management programs that can match the machine’s speed.”
However, Nick Mo, CEO & co-founder, Ridge Security Technology, added that open source, open-weight models have similar capabilities today.
“With so many 'abliterated' models in the market, bad actors are already using these advanced capabilities for malicious purposes,” he said. “Self-policing and limiting access for legitimate customers only makes the cybersecurity landscape more challenging.”
John Strand, owner of Black Hills Information Security, argued that frontier AI companies can’t be trusted to self police.
“I guess it’s great that they’re now saying they’re going to slow down and put additional safeguards in place. But remember, these are the same people who were warning the rest of us about the need for safeguards more than a year ago. And they didn’t do it themselves,” he said.
“There needs to be some type of meaningful oversight and accountability. As much as these companies may hate that idea, they have demonstrated again and again that we cannot simply assume they’re going to do the right thing on their own.”