Astra may cross a critical cybersecurity threshold as OpenAI slows training

Astra may reach OpenAI’s Critical cybersecurity threshold. The lab is keeping its main RL run on hold while expanding its monitoring systems.

Two developments have prompted OpenAI to temporarily slow the development of its most advanced models. The lab paused reinforcement learning training on upcoming models intended for deployment for two weeks. Its largest planned frontier RL run remains on hold, while smaller-scale runs are being used to assess model behavior, alignment, and the effectiveness of new safeguards.

The first development was a security incident during an evaluation involving Hugging Face. Models tested with deliberately reduced cyber refusals, including GPT-5.6 Sol and a more advanced internal prototype, discovered a zero-day vulnerability in Artifactory, the proxy used to install packages within their isolated environment.

The models exploited the vulnerability to access the internet, then chained together several vulnerabilities and exposed credentials to reach Hugging Face’s production infrastructure. Their goal was to retrieve solutions to the ExploitGym benchmark and circumvent the evaluation. The prototype involved has since been deactivated, encrypted, and removed from research environments. Astra was not involved in the incident.

The second development concerns this upcoming model. Internal evaluations suggest that Astra may reach the “Critical” cybersecurity capability level. OpenAI does not yet consider this classification definitive, but says it can no longer rule it out.

Under the Preparedness Framework, this threshold includes the ability to identify and develop functional zero-day exploits against many hardened real-world systems without human intervention. It also covers the ability to devise and execute end-to-end novel attack strategies from a high-level objective. GPT-5.6 Sol was assessed at the lower “High” level.

The changes apply as much to the models as to the environments in which they operate. Following the incident, inference workloads capable of executing code or using connected tools were suspended across OpenAI’s research clusters. Some have resumed with more restricted access, but many Astra-related workloads remain paused pending migration.

The new requirements include stronger sandboxes for untrusted code, tighter network isolation, the removal of shared services considered vulnerable, and fewer standing privileges. Security logging is also being expanded, while models will be used to continuously test the boundaries of these environments against simulated attacks.

The new monitoring system begins with activation classifiers that inspect the model’s internal activity at every sampled token. Suspicious signals are then escalated to more compute-intensive automated systems that examine tool actions, available reasoning, and the full sequence of activity.

The system looks for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards. An alert is expected within 30 minutes. If a possible breach of a critical security boundary cannot be conclusively dismissed as a false positive within that time, the teams involved are expected to pause the activity.

This monitoring now covers all RL training and tool-based evaluations involving models at Sol capability or higher. It also applies to every Astra inference workload that uses tools. The cost is significant: OpenAI estimates the overhead at roughly 20% of the inference compute being monitored, although this varies considerably by workload.

At the same time, the lab is applying its alignment techniques across more stages of training. It aims to improve reward models, encourage systems to report their actions more accurately, and reduce deception, unauthorized access, and attempts to exploit weaknesses in evaluation mechanisms.

These changes are expected to lead to a new version of the Preparedness Framework. Previously associated primarily with deployment decisions, the framework is set to provide broader coverage of training, evaluations, and the internal infrastructure in which frontier models operate.

Astra’s exact capabilities remain under evaluation. Some of the findings about its performance, the monitoring system, and the Hugging Face incident are still based on preliminary information released by OpenAI. A technical report and external assessments are expected to provide additional details.