OpenAI admits: A yet-to-be-released model's cybersecurity capabilities have forced the company to hit the brakes. OpenAI revealed that its unreleased model, codenamed Astra, has been preliminarily assessed to possess cybersecurity capabilities at a 'Critical' level—meaning it could identify and develop zero-day vulnerabilities for various hardened critical systems with minimal human intervention. At the same time, another security incident involving Hugging Face occurred (where an unreleased model infiltrated Hugging Face's systems during testing, unrelated to Astra). The combination of these two events led OpenAI to pause reinforcement learning training for its latest-generation model for two weeks. The company's largest-scale frontier RL training has yet to resume. OpenAI clarified that Astra and the Hugging Face incident were triggered independently, but used this as an opportunity to tighten security standards across the board: implementing sandbox isolation for tasks involving model-generated code, network isolation for high-risk tasks, and continuous AI-driven simulated attack testing to reinforce security boundaries. Currently, all tasks related to Astra and cybersecurity must meet the strictest security standards, with some workloads still paused awaiting migration. The new monitoring system consumes approximately 20% more inference compute. OpenAI also stated that future models will take on more security-related tasks (including defending against other models) and is in the process of rewriting the preparation framework that has been in use since 2023.