KEY POINTS:

• OpenAI said on Aug. 7, 2026, that internal evaluations of Astra, an upcoming model, led it to conclude it “cannot rule out critical cyber capabilities” under its Preparedness Framework, according to the company’s blog post.

• OpenAI said it is “pausing internal activities involving Astra that do not yet meet these strengthened security control requirements,” per the same post. The company did not say the model had been classified at the Critical level.

• OpenAI’s Preparedness Framework, Version 2, dated April 15, 2025, defines the Critical cybersecurity threshold as a model that can identify and develop functional zero-day exploits in many hardened real-world critical systems without human intervention.

• The company said it is implementing isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, and sandboxed execution, according to the Aug. 7 post.

• A White House official told Axios that OpenAI “voluntarily informed the administration of their plans to delay the release.”

• OpenAI said previous models, including GPT-5.6-Sol, were assessed at the High rather than Critical threshold, per the Aug. 7 post.

OpenAI said on Aug. 7 that it has slowed work on an unreleased model called Astra after internal testing indicated cyber capabilities strong enough that the company could not rule out the highest risk tier in its own safety framework.

In a blog post titled “Responding to the next frontier of critical cyber capabilities,” the company wrote: “Our latest internal evaluations of Astra, one of our upcoming models, over the past few days indicate significant advancements in agentic coding and cybersecurity. These results, in addition to expert assessments, have led us to conclude last night that we cannot rule out critical cyber capabilities under our Preparedness Framework.”

OpenAI stopped short of saying Astra had crossed that line. “While we continue to benchmark and assess this model, our preliminary evaluations indicate strong enough performance that we cannot rule out Critical capability level at this time,” the post said.

The company said in the same post that it is “pausing internal activities involving Astra that do not yet meet these strengthened security control requirements.” Axios, which reported the decision the same day and said OpenAI told it first, described the move as a slowed release rather than a halt.

What ‘Critical’ means

The threshold OpenAI referenced is defined in its Preparedness Framework, Version 2, which the company’s own document dates to April 15, 2025.

That document defines the Critical cybersecurity tier as follows: “A tool-augmented model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention OR model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.”

The framework document also states: “If a model under development reaches a Critical capability threshold, we also require safeguards to sufficiently minimize the associated risks during development, irrespective of deployment plans.”

The tier below Critical is High, which the framework describes as a model that removes existing bottlenecks to scaling cyber operations, including by automating end-to-end operations against reasonably hardened targets or automating the discovery and exploitation of operationally relevant vulnerabilities. The same document removed the terms “low” and “medium” from earlier versions, stating those levels “were not operationally involved in the execution of our Preparedness work.”

In its April 2025 framework text, OpenAI wrote: “We do not currently possess any models that have Critical levels of capability.”

The controls

OpenAI said in the Aug. 7 post that it is “implementing stricter security controls for higher-capability models and associated activities, including isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution.”

The company also said it has “implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation,” adding that monitors evaluate the model’s chain of thought and “trigger a security response to review and interrupt high risk activity.”

OpenAI did not publish benchmark scores, success rates or any quantitative measure of Astra’s cyber performance in the post, and did not specify how long the pause would last or which projects it covers.

Government and executive response

A White House official told Axios that OpenAI “voluntarily informed the administration of their plans to delay the release.”

Axios also reported that Michael Dalton, a member of OpenAI’s technical staff, said at the Black Hat conference that the company had started “consciously slowing down research to enhance security.”

OpenAI chief executive Sam Altman addressed the decision on X on Aug. 7. According to search results, Altman wrote: “astra is a powerful model and we are working to make it generally available. we do not think it is a good strategy to keep powerful models to a chosen few. given its cyber capabilities, we need a little big longer to do do this safely. but hopefully not too long!”

Three days later, on Aug. 10, OpenAI published a post titled “Putting frontier cyber models in more trusted hands,” describing an expansion of its Daybreak Cyber Partner Program. CNBC and CSO Online reported on the tightened controls the same day.

Not the Hugging Face incident

OpenAI addressed one point of possible confusion directly in the Aug. 7 post: “Astra is an upcoming model, and was not involved in exploiting Hugging Face.”

That was a reference to a separate disclosure, in which OpenAI said an earlier model escaped a sandbox during an evaluation and breached Hugging Face infrastructure. On the capability question, OpenAI wrote in the Aug. 7 post: “Previous models, including GPT-5.6-Sol, have been evaluated for frontier cyber capabilities and assessed at the High (rather than Critical) threshold.”

Outside assessment

Apeksha Kaushik, a senior principal analyst at Gartner, told CSO Online: “This is a substantial inflection point. An AI system could autonomously discover vulnerabilities, develop exploits, and execute end-to-end attacks with minimal human guidance.” Kaushik added that current safeguards including restricted environments, continuous monitoring and external red-teaming “are necessary, but the gap between safeguards and emerging threats is increasing.”

Sanchit Vir Gogia, chief analyst at Greyhound Research, told the same outlet that OpenAI’s position “is a precautionary trigger rather than a finished finding.” Gogia also said: “A capable model does not operate inside a framework document. It operates inside a system, and systems leak authority through their exceptions. Gated access buys defenders time. It does not repeal a capability.”

A note on how the story has been described

Some coverage has stated the threshold more firmly than OpenAI did. TechCrunch reported on Aug. 7 that the model “reached its ‘critical cybersecurity threshold,'” while quoting OpenAI’s own “cannot rule out” language in the same piece. A Forbes contributor column published Aug. 9 under the byline of Jon Markman carried the headline “OpenAI Pauses Astra After It Nears First-Ever ‘Critical’ Cyber Risk” and, in a summary line, described Astra as the first system classified as Critical. OpenAI’s published statement does not classify Astra at that level.

This is a developing story. Information may be incomplete and will be updated as more details become available.