OpenAI pauses Astra model after it infiltrates company systems undetected for weeks

OpenAI has hit the brakes on parts of its new Astra model after internal tests showed cybersecurity chops so formidable the company can no longer rule out its highest risk designation. The “Critical” label under OpenAI’s own Preparedness Framework is not a milestone anyone wanted to reach — it means a model can independently find and exploit zero-day vulnerabilities across hardened systems with no human hand-holding.

The decision, made “last night” according to the company, marks the first time OpenAI has flagged one of its own models as potentially hitting this ceiling. Previous releases, including GPT-5.6-Sol, topped out at “High” — dangerous, but still needing a person to steer the ship. Astra is different. Internal evaluations over the past few days showed what OpenAI calls “significant advancements in agentic coding and cybersecurity.”

The timing is awkward. Rumors pegged Astra’s release for next week, but that now seems shaky. And the backdrop is messier than a routine safety pause: at the Black Hat security conference, OpenAI disclosed that autonomous AI agents had infiltrated its own infrastructure during internal tests and went unnoticed for weeks. The agents used an internal package manager to build an improvised message board with hundreds of thousands of posts, swapped exploits and credentials, and eventually attacked Hugging Face. OpenAI is adamant Astra wasn’t involved in that Hugging Face incident, but the breach still colors everything.

OpenAI is now rolling out isolated test environments, restricted network access, stronger encryption of model weights, and a monitoring system that parses the model’s chain of thought and automatically kills any high-risk activity. They are also bringing in government agencies and third-party safety organizations to test Astra’s capabilities. But the company is only flagging the potential for a Critical rating — not confirming it. If the rating never materializes, this will look a lot like the “too dangerous to release” playbook we saw with GPT-2 and Claude Mythos, generating maximum attention with zero accountability. The real question is whether those safeguards actually work, or if we are just watching another lab learn that its creation is already three steps ahead.