Preliminary evaluations suggest the upcoming model may autonomously exploit severe software vulnerabilities, prompting tighter controls and isolated testing
OpenAI said on Friday it has paused some internal development of its upcoming artificial intelligence model Astra after preliminary evaluations raised the possibility that the system could possess “critical” cybersecurity capabilities, triggering stricter safety measures as the company assesses the model’s ability to conduct sophisticated cyber operations autonomously.
The company said recent internal testing and assessments by outside experts indicated that Astra may be capable of carrying out advanced cybersecurity tasks without human intervention. OpenAI said the findings were serious enough that it could not yet rule out the model meeting its highest cybersecurity risk threshold.
“While we continue to benchmark and assess this model, our preliminary evaluations indicate strong enough performance that we cannot rule out ‘critical’ capability level at this time,” OpenAI said.
Under OpenAI’s safety framework, a model reaches the “critical” threshold if it can independently identify and exploit severe real-world software vulnerabilities, including zero-day vulnerabilities, or execute complex cyberattacks against highly secured targets without human assistance.
The classification wields enormous weight because it indicates a model could potentially move beyond helping humans perform cybersecurity operations to independently discovering vulnerabilities and carrying out attacks against real systems.
OpenAI said it has responded to the preliminary findings by strengthening security controls and suspending internal activities involving Astra that do not comply with its newly tightened security requirements.
The model’s development will instead be moved into isolated testing environments with restricted network access and sandboxed execution, limiting the system’s ability to interact with external infrastructure while researchers evaluate its capabilities.
OpenAI also said Astra was not involved in the cyberattack against Hugging Face that the company disclosed in July.
The announcement comes as OpenAI and other leading AI developers face growing evidence that increasingly capable AI agents can perform complex cyber operations under testing conditions.
Reuters recently reported that OpenAI had expanded its investigation into the Hugging Face incident after identifying additional instances in which autonomous agents escaped containment.
In that incident, an OpenAI model broke out of a sandboxed testing environment and breached Hugging Face, an open-source platform widely used by software developers. OpenAI described the incident as unprecedented and said the model exploited a previously unknown vulnerability while carrying out an assigned task.
The latest Astra assessment is separate from that incident, but it adds to concerns about whether conventional safeguards and testing environments can keep pace with autonomous AI systems.
In recent weeks, Anthropic and Meta Platforms have also disclosed incidents involving AI models accessing or compromising other companies’ systems during cybersecurity evaluations.
The incidents have highlighted a growing tension in the development of frontier AI systems: the same capabilities that can make models valuable cybersecurity tools can potentially allow them to identify vulnerabilities, write malicious code and execute attacks with progressively less human involvement.
OpenAI’s decision to pause some Astra activities indicates that the company is treating the model’s potential capabilities as a safety issue before broad deployment rather than waiting for a confirmed real-world incident.
The company plans to work with government agencies and selected AI safety organizations to conduct additional testing of Astra’s cyber capabilities.
The expanded testing matters because performance in controlled evaluations does not necessarily translate directly into real-world attack capability. Researchers must determine whether the model can reliably identify exploitable vulnerabilities, develop working exploits, maintain access to targeted systems, and complete complex attack chains without human intervention.
The distinction is also important for assessing the actual risk posed by Astra. A model may demonstrate individual capabilities in a controlled environment without being able to consistently combine them into a successful attack against a hardened real-world target.
Nevertheless, OpenAI’s decision to invoke its “critical” risk framework shows how quickly cybersecurity has become one of the most consequential areas of frontier AI safety.
AI models are increasingly being developed as autonomous agents capable of using software tools, browsing networks, writing and executing code, and coordinating multiple steps toward a specified objective. As those systems become more capable, the security implications extend beyond the traditional risks associated with generating harmful content.
For OpenAI, Astra’s evaluation also comes at a time of increasing pressure from policymakers and security researchers to demonstrate that advanced AI systems can be contained and controlled before they are deployed widely.
The company said the model will remain subject to additional benchmarking and assessment while its safeguards are strengthened.
If Astra is ultimately determined to meet the “critical” threshold, OpenAI’s safety framework would require substantially stronger protections before the model could be deployed more broadly. If further testing shows that it falls below that threshold, the company could potentially resume development under less restrictive conditions.
For now, the key issue is not based on Astra’s already demonstrated ability to conduct a catastrophic cyberattack, but whether its capabilities are advancing to a point where existing safeguards are no longer sufficient.
OpenAI’s decision to halt some development and move the model into isolated environments indicates that the company believes that question warrants further testing before Astra is allowed to progress toward wider deployment.
