OpenAI Slows Astra After Tests Flag “Critical” Cyber Capability

OpenAI slowed work on Astra on August 7 after preliminary internal evaluations and expert assessments found major advances in agentic coding and cybersecurity. In its Astra safety disclosure, the company stated that it could not rule out Critical cyber capability, was expanding safeguards testing and had paused internal activities that did not meet stronger security requirements.

The change affects development and evaluation inside OpenAI. It is not a final finding that Astra has crossed the Critical threshold, and it is not evidence of a cancelled launch. Axios’s account of the slowdown described a possible future release delay, but the model’s timing was already unclear and no dated launch schedule was made public.

What Astra’s preliminary tests established

The evaluations raised a serious possibility rather than producing a final public classification. Astra showed sufficiently strong performance for evaluators to keep the Critical tier in consideration, but benchmark scores, individual task results and a completed system card have not been published.

“Critical” is therefore the capability threshold that the preliminary results could not exclude. It does not mean Astra has publicly demonstrated every criterion in that tier, and it is not an ordinary severity label for a software vulnerability.

Astra is identified as an upcoming model. It was not involved in the earlier Hugging Face security incident, so that episode does not establish what Astra can do and cannot substitute for the unpublished evaluation results.

What a Critical cyber rating means

OpenAI’s Preparedness Framework defines the Critical cyber threshold as a tool-augmented model that can develop functional zero-day exploits across many hardened, real-world critical systems without human intervention, or devise and execute novel end-to-end attacks against hardened targets from only a high-level goal.

That is above the framework’s High tier. High capability includes removing existing bottlenecks in cyber operations, such as automating attacks against reasonably hardened targets or automating the discovery and exploitation of operationally relevant vulnerabilities. Critical capability marks a qualitatively new threat vector for severe harm without a ready precedent.

The distinction changes the required response. A model at High capability needs effective safeguards before deployment and appropriate security controls during development. If a model under development reaches Critical capability, associated risks must also be sufficiently reduced during development, regardless of whether deployment is imminent.

The rating concerns the strongest capability evaluators can elicit from a covered system, not simply the behavior of a default consumer chatbot. Testing may use tools, agent scaffolding, permissive evaluation variants and system settings intended to reveal abilities that ordinary product restrictions could suppress.

Why the evaluations are expanding

The uncertainty itself requires deeper testing because a single evaluation can underestimate a frontier model. Better prompts, tools or agent scaffolds may reveal capabilities that a simpler test misses, making an early result a lower bound rather than a reliable ceiling.

The expanded work has two separate aims: establish Astra’s upper capability boundary and determine whether safeguards remain effective under demanding conditions. Those are different questions. A capability evaluation asks what the model can accomplish; a safeguards evaluation asks whether controls can prevent the resulting capability from creating unacceptable risk.

The strengthened controls include isolated testing environments, restricted network and tool access, enhanced protection and encryption for model weights, sandboxed execution, and additional monitoring and detection. Agentic Astra applications used in training and evaluation are subject to monitoring for risky actions and misalignment, with high-risk activity routed for review and possible interruption.

The evaluation plan also includes work with relevant government agencies and selected AI-safety organizations, plus recommended security controls for third-party testing partners. The participating organizations, testing timetable and publication schedule for the assessment remain unspecified.

What has slowed—and what has not

The narrow action is a pause on internal Astra activities that do not yet satisfy the strengthened controls. That is not the same as stopping every training run, experiment or safety evaluation. Work that meets the new requirements can continue while other activities wait for an approved environment and protections.

The decision can be understood as four distinct stages: preliminary results raised the possibility of Critical capability; additional evaluation and safeguards work began; some internal activity paused, slowing development; and a separate deployment decision remains outstanding. The public record establishes the first three stages, not the fourth.

This distinction matters when describing a release delay. Slower development can move a future launch later, but a formally scheduled delay ordinarily requires an earlier timetable, an explicit postponement or a replacement date. None of those elements is currently public.

No Astra release date is established

The public materials provide no date for Astra’s release, no product through which users would receive access and no indication of whether availability would begin with a restricted group. The extra controls and testing make a later launch possible, but there is no public date against which a delay can be measured.

The next substantive evidence could take the form of a final capability assessment, external testing results, a safeguards report, a system card or an explicit deployment decision. For now, Astra remains an unreleased model under expanded evaluation, with some internal activities paused and its launch timetable unresolved.

Also read:

• OpenAI Claps Back Hard at Anthropic with GPT-5.4-Cyber: Real Cyber Defense for the Actual World, Not Just the Elite
• AI Safety Researcher Quits OpenAI, Saying Its Trajectory Alarms Her
• OpenAI's Strawberry "Thought Process" Sometimes Shows It Scheming to Trick Users