OpenAI slows Astra scaling after cybersecurity risk finding
OpenAI says two developments over the past several weeks pushed it to slow the pace of scaling its frontier models: the OpenAI-Hugging Face incident, which the company references twice but does not describe, and preliminary evidence that an upcoming model, Astra, may meet the Critical cybersecurity capability threshold under OpenAI's Preparedness Framework. In response, OpenAI imposed a two-week pause in reinforcement learning (RL) training on its latest models intended for deployment while it hardened and red-teamed its research environments and widened the coverage of its monitoring systems. Its largest planned frontier RL run remains on hold while smaller-scale training and evaluations continue to assess model behavior and validate safeguards.
Immediately after the Hugging Face incident, OpenAI paused frontier model inference in research clusters for any runs that could execute code or reach the internet. It restored a limited, more secure path for code execution, then reviewed each workload individually before allowing it to resume. Over the following weeks OpenAI defined stronger security requirements for frontier research workloads: tighter workload isolation (sandboxes) for anything running model-generated or untrusted code, network isolation so a single compromised workload cannot by itself reach the internet or other internal systems, and continuous security testing that includes using OpenAI's own models to probe these boundaries against simulated attacks. OpenAI states it has now determined that Astra models may have a critical level of cyber capability, and applies its strictest security tier to all workloads involving Astra or other cyber-related models. A significant number of workloads remain paused until they are migrated to meet the new bar, with safety and alignment work prioritized first.
OpenAI also overhauled its monitoring. The new setup runs activation classifiers, which inspect a model's internal activity, on every sampled token, escalating flagged activity to more sophisticated automated investigators that examine tool actions, reasoning and the full sequence of activity for unauthorized access, data theft, destructive behavior or attempts to defeat safeguards. OpenAI aims to issue an alert within 30 minutes of concerning activity being surfaced; a flag against a critical security boundary pages the safety, security and research teams, who are expected to pause the activity if they cannot conclusively rule out a false positive within 30 minutes. This monitoring is required for all RL training and evaluation involving tools on models of Sol capability or higher, a threshold the source does not further define. After determining on August 7 that Astra may have critical cyber capabilities, OpenAI added a further requirement to monitor all inference of Astra with tools, not only RL training and evaluations. OpenAI estimates the monitoring overhead at roughly 20% of the inference compute being monitored, though it says the cost varies substantially by workload.
On alignment, OpenAI says it is now applying its core techniques across more stages of training for its most capable models: improving reward models to detect and discourage unsafe behavior, training models to be more honest about their actions and limitations, and reducing behavior that exploits weaknesses in rewards, graders, tools or oversight. The company frames all of this as building toward an evolved Preparedness Framework, says it expects models themselves to soon drive most security work including defending against other models, and says it intends to involve external organizations and publish more detail, including a forthcoming blog post on the monitoring system and a technical report on the Hugging Face incident.
Key facts
- Preliminary evidence suggested OpenAI's upcoming model, Astra, may meet the Critical cybersecurity capability threshold under OpenAI's Preparedness Framework; OpenAI has since determined Astra models may in fact carry a critical level of cyber capability.
- OpenAI ran a two-week pause in reinforcement learning training on its latest models intended for deployment, and its largest planned frontier RL run remains on hold pending further safeguard validation.
- A new monitoring system runs activation classifiers on every sampled token, aims to alert within 30 minutes of concerning activity, and gives paged safety, security and research teams 30 minutes to rule out a false positive on a critical-boundary flag before they are expected to pause the activity.
- Monitoring overhead is estimated at roughly 20% of the inference compute being monitored; after determining on August 7 that Astra may have critical cyber capability, OpenAI extended the monitoring requirement to all inference of Astra with tools, not just RL training and evaluations.
- The safeguards followed the OpenAI-Hugging Face incident, which paused frontier model inference in research clusters for runs able to execute code or reach the internet; OpenAI says it will publish a technical report on that incident and more detail on the monitoring system.
Why it matters
This is OpenAI publicly describing a case where its own Preparedness Framework, the internal system meant to flag when a model's capabilities cross a risk threshold, triggered a real slowdown: a two-week RL training pause and a frontier run still on hold. It ties that slowdown to a specific trigger, Astra's cyber capability assessment, and to a second unexplained incident involving Hugging Face. The post also signals that OpenAI's existing framework was not built for what it is now seeing, since the company says it needs a broader approach that extends beyond it.
Who it affects
Directly, OpenAI's own research, safety and security teams, whose workflows now run under stricter isolation, monitoring and pause authority, and any workload OpenAI classifies as Astra or cyber-related. More broadly, it affects the AI safety and policy community watching whether frontier labs will actually slow down and disclose when their own thresholds are crossed, and the external organizations OpenAI says it intends to involve as this approach develops.
How to use it
There is no product or release here to use. For readers tracking OpenAI's safety commitments, the concrete markers to watch for are the promised technical report on the Hugging Face incident and the forthcoming blog post detailing the monitoring system; neither had been published as of this post.
How solid is it
This is OpenAI's own account, published on its blog, of its own internal processes; nothing here is independently verified. The company is explicit that its first characterization of Astra was preliminary evidence of meeting the Critical threshold, and only later states it has determined that Astra models may have a critical level of cyber capability, a firmer but still qualified claim. No dates bound the two-week pause, and OpenAI does not name any individual involved.
Risks and caveats
The OpenAI-Hugging Face incident is mentioned twice but never explained: what happened, when, or its consequences are not in this text. The 'Sol capability' threshold that triggers mandatory monitoring is referenced without definition. The 30-minute false-positive window ends in teams being 'expected' to pause an activity, not required to, which leaves room for judgment calls under pressure. The 20% monitoring overhead figure is an estimate that OpenAI says varies substantially across workloads.
“The capabilities of frontier models are rapidly accelerating. Our ability to understand, align, and secure them must stay ahead.”
— OpenAI