OpenAI has temporarily slowed the pace of its frontier model development after determining that an upcoming model, internally named Astra, may meet the company's threshold for critical cybersecurity capabilities under its Preparedness Framework. The decision follows two recent developments: a security incident involving a Hugging Face model evaluation and preliminary evidence that Astra could autonomously execute significant cyber operations.
OpenAI's largest planned reinforcement learning run remains on hold while the company conducts smaller-scale training and evaluations to validate safeguards and gather stronger evidence of alignment before proceeding. The company announced a two-week pause in reinforcement learning training on its latest deployment-bound models to harden research environments, expand monitoring coverage, and red-team its infrastructure.
What's new
- Model: Astra (upcoming frontier model)
- Capability threshold: Critical cybersecurity capability under OpenAI's Preparedness Framework
- Determination date: August 7
- Immediate action: Two-week pause in frontier RL training; largest planned RL run remains on hold
- Monitoring overhead: Approximately 20% of inference compute for monitored workloads
- Alert target: Issue alert within 30 minutes of concerning activity; page safety, security, and research teams
Strengthened research safeguards
OpenAI's approach now rests on three reinforcing safeguards: monitoring, alignment, and security measures. The company expects models to soon drive most security work, including defending against other models, allowing all three safeguards to scale with capability.
Securing research environments
Following the Hugging Face incident, OpenAI paused frontier model inference in research clusters for workloads that could execute code or access the internet. The company has since implemented stronger isolation requirements.
- Workload isolation: Stronger sandboxes for workloads executing model-generated or untrusted code, including software that could be compromised while processing model outputs
- Network isolation: Controls to isolate higher-risk workloads from the internet, designed so a single compromise does not allow unauthorized internet or internal network access
- Continuous security testing: Removal of potentially vulnerable shared services, reduction of standing privileges, improved security boundaries, enhanced log collection, and automation using models to test boundaries against simulated attacks
The strictest safeguards now apply to all workloads involving Astra or cyber models, as well as all other cyber-related workloads.
Expanded chain-of-thought monitoring
OpenAI has revised its monitoring to a multistage system. Activation classifiers run at every sampled token, escalating potential concerns to increasingly sophisticated automated investigators that examine tool actions, reasoning, and full activity sequences for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards. The system targets a 30-minute alert window. If teams cannot conclusively determine a flag is a false positive within 30 minutes, they are expected to pause the activity.
Monitoring is now required for all RL training and evaluations involving tools for models of "Sol" capability or higher. Since the August 7 determination on Astra, an additional monitoring requirement applies to all Astra inference with tools, not just RL training and evaluations.
Advancing alignment research
For RL runs on the most capable models, OpenAI is applying core alignment techniques across more training stages. This includes improving reward models to detect and discourage unsafe behavior, training models to be more honest about actions and limitations, and reducing reward-hacking behaviors that exploit weaknesses in rewards, graders, tools, or oversight. The company is also increasing training coverage for behaviors that could cause harm when models interact with external systems.
Why it matters
The pause signals a shift in how frontier AI labs manage the transition from research to deployment when models cross critical capability thresholds. OpenAI's disclosure that monitoring overhead consumes roughly 20% of inference compute highlights the growing resource tax of safety infrastructure. The requirement to pause activity if a 30-minute investigation cannot rule out a false positive introduces a new operational constraint on frontier training runs. External benchmarks from AISI show cyber task horizons doubling every 4.7 months since late 2024, with recent models significantly outpacing that trend, suggesting the window for implementing such safeguards is narrowing across the field.
Our take
OpenAI's decision to halt its largest RL run rather than deploy and monitor reactively marks a meaningful departure from the "ship and iterate" cadence that has defined recent frontier releases. The 20% monitoring tax and mandatory 30-minute pause are concrete numbers the field can benchmark against — future frameworks will likely be measured by whether they adopt comparable operational rigor.
