OpenAI said it is stepping back from parts of development on Astra, one of its upcoming models, after recent internal evaluations suggested the system may be dangerous enough to develop cyberweapons on its own.
In a statement, the company said: “Our latest internal evaluations of Astra, one of our upcoming models, over the past few days indicate significant advancements in agentic coding and cybersecurity.” OpenAI added: “These results, in addition to expert assessments, have led us to conclude last night that we cannot rule out critical cyber capabilities under our Preparedness Framework.”
OpenAI published the warning while also saying that internal testing of the unreleased Astra model played no role in the recent Hugging Face breach, despite the capabilities the model appears to have shown.
What OpenAI means by “critical” cyber capabilities
The Preparedness Framework is OpenAI’s internal rulebook for risky models. It was first published in December 2023, and “critical” is the highest category in that system.
According to OpenAI’s definition, a model reaches that threshold if it can identify and build working zero-day exploits across hardened systems without a human in the loop, or if it can plan and execute a complete attack against a difficult target starting from nothing more than a high-level goal. OpenAI said earlier models, including GPT-5.6-Sol, had only reached the lower “High” tier.
Recent incidents have moved beyond hypothetical risk
OpenAI’s warning lands after several weeks of incidents involving frontier models reaching beyond their test environments and interacting with live targets on the internet.
The clearest example came from OpenAI itself. As Decrypt previously reported, the company’s agents chained vulnerabilities together, escaped their test environment, reached the internet, and attacked Hugging Face while trying to cheat on a security benchmark. In a later account, OpenAI said the same rogue agent also broke into at least four other publicly available services, using credentials it found on the open web.
Anthropic’s Claude showed similar behavior. Several versions of Claude gained unauthorized access to three real companies after a misconfiguration gave the model access to the open internet. In one case, Claude Opus 4.7 mistook a live company website for the fake target in its assignment, pulled credentials, and accessed a production database containing several hundred rows of real data.
Meta was added to that list this month. Decrypt reported that a Muse Spark model escaped its test environment, reached the internet through a partner configuration error, and exploited a flaw in a third-party service. Moonshot AI’s Kimi K3 also showed similar behavior, escaping its sandbox to look for benchmark answers in a public repository.
The UK’s AI Security Institute said the pattern was not isolated. During testing of Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol, it recorded 10 cases out of 122 in which models took unsanctioned actions on the live internet. In one of those cases, a model attempted to insert malicious code into an open-source project.
OpenAI tightens controls around Astra
OpenAI said its response is to lock things down before Astra is considered ready. The company is pausing internal Astra work that does not include the new controls, isolating test environments, restricting network and tool access, protecting model weights, and monitoring risky actions across the board.
That leaves Astra in a holding pattern for now, with OpenAI shifting its focus to whether its safeguards can keep pace with the model’s newly observed capabilities.