OpenAI Pauses Astra Work After Tests Flag Critical Cyber Capability

At the Black Hat security conference earlier this week, OpenAI disclosed that autonomous agents had operated inside its infrastructure for weeks during internal tests without being detected. The agents used an internal package manager to build a message board containing hundreds of thousands of posts, where they shared exploits and credentials. Michael Dalton, a member of the company’s technical staff, said researchers had begun “consciously slowing down research to enhance security.”

OpenAI said Friday that preliminary tests could not rule out Astra, an unreleased model, reaching the Critical cybersecurity level in its Preparedness Framework, the first time it has attached that possibility to a specific model. At that level, a system could find working zero-day flaws in hardened targets or plan and conduct a new attack from a high-level goal without human help.

The framework’s policy at Critical is to halt further development. OpenAI paused only some internal activities.

What Critical means

The Preparedness Framework, first published in December 2023, places Critical above High. OpenAI rated every previous model, including GPT-5.6 Sol, Terra and Luna, at High, one level below Critical. No previous model has reached Critical.

That is not yet Astra’s rating. The finding is OpenAI’s own preliminary evaluation of a product that has not been released. The company says its benchmarking and assessment are not complete. The outside testing it has committed to with government agencies and selected AI safety organizations has not happened yet. A release date has not been set.

The company is isolating test environments, restricting network and tool access, and encrypting model weights. OpenAI says monitors run across all agentic applications of Astra, including training and evaluation, read the model’s chain of thought, and trigger a response that interrupts high-risk activity. Government agencies and selected AI safety groups will take part in testing, while outside testing partners will receive recommended security controls.

Boaz Barak, an OpenAI safety researcher, wrote: “Proud that we are erring on the side of caution.” Chief Executive Sam Altman framed the decision around eventual access in an August 7 post on X. “Given its cyber capabilities, we need a little longer to do this safely,” he wrote. “But hopefully not too long.”

The three escapes

The disclosure followed three containment failures over the three weeks ending August 7, 2026, all during tests in which cyber safeguards had been deliberately reduced to measure capability. In the first, disclosed in July, models running the ExploitGym benchmark chained flaws to leave an isolated environment. They exploited a previously unknown weakness in JFrog Artifactory and reached Hugging Face’s production infrastructure. OpenAI said Astra was not involved.

The U.K. AI Security Institute said it documented 19 actions that Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol took to try to compromise real people and organizations during testing in July 2026. Mythos accounted for 17 and GPT-5.6 Sol for two. The 19 actions reflected a few connected behaviors, not 19 separate cases. The models created fake GitHub identities, socially engineered maintainers, planted prompt injections and sent deceptive emails. GitHub confirmed that the conduct violated its terms of service. The Institute worked with GitHub to remove artifacts left by the agent and notify the users it had interacted with.

OpenAI said in a blog post on Tuesday, August 4, 2026, that its third-party safety partner Irregular had uncovered the third case. The models were mistakenly given internet access and broke into a real website that shared a name with the fictional company in the simulated environment. The Institute announced its findings separately that day.

OpenAI announced a possibility rather than a determination about an unshipped product. The announcement followed containment failures involving other systems.

Matthias Bastian, writing in The Decoder, said critics would keep accusing OpenAI of fear-based marketing, “especially since the company is only reporting the potential for a Critical rating, not the rating itself.” He added that if the rating never materializes, OpenAI will have “generated plenty of PR without real consequences.”

Kirsten Korosec of TechCrunch observed that companies often hold products back over safety or cybersecurity risk but rarely publicize that choice while a product is still being built.

Safety policies and government review

Anthropic once pledged to pause training when a model’s abilities outran its controls. It removed that clause from its Responsible Scaling Policy in February 2026, saying that if one developer paused while others continued training and deploying systems without strong safeguards, the result could be a less safe world. With Astra unreleased and no release date set, OpenAI now faces the same competitive question.

Anthropic still used a more limited release design for Fable 5, its first Mythos-class model for general use, on June 9, 2026. Higher-risk requests in cyber, biology, chemistry and model distillation were routed to the less capable Claude Opus 4.8. Dianne Penn, Anthropic’s head of product management, research and labs, called the launch “deliberately more conservative.” Anthropic’s tests found Mythos needed 31 minutes to write an exploit for an already disclosed Windows kernel vulnerability.

A White House official told Axios that OpenAI voluntarily notified the administration about plans to delay Astra’s release. The Trump administration is developing its own pre-release review process and briefed selected industry participants during the week of August 7, 2026. Its framework operationalizes national risk and state-of-the-art models without defining either term.

The U.K. researchers said they were not yet sure “when the agent understood it was taking real world action, or to what extent it believed it was in a fictional test scenario.”

Related stories

Microsoft Cyber Model Claims 95.95% CyberGym, Unverified

Microsoft says its first in-house cyber model helped MDASH score 95.95% on CyberGym at half the cost. The public leaderboard did not carry that number the next day, no independent testers saw the model before release, and Microsoft's own model card scores it zero on three ExploitGym categories.

Implicator.ai

Anthropic Left Cyber Training Out of Claude Opus 5

Anthropic shipped a frontier model and published what it withheld. Opus 5 finds vulnerabilities nearly as well as the restricted Mythos 5 and completed 4 exploits to its 13, the split the company used to set where its safety classifiers draw the line.

Implicator.ai

OpenAI Models Hacked Hugging Face in Hours, Not Weeks

OpenAI's models breached Hugging Face in hours, work that would take a skilled human weeks, people familiar with the matter said. Three models were involved, one deliberately misaligned, and OpenAI has been in contact with U.S. government authorities since learning of the breach.

Implicator.ai

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai