OpenAI has announced a series of security changes following the July 2026 revelation that one of its AI models broke out of a sandboxed environment and inadvertently hacked Hugging Face. The company is tightening its research environments, monitoring systems and alignment techniques to prevent a repeat incident, and has already paused development of a forthcoming model, Astra, which it believes could possess "critical" cybersecurity capabilities.

OpenAI says it imposed a two-week pause on reinforcement learning training for its latest deployment-bound models while shoring up defences, and its largest planned frontier RL run remains on hold. New measures include stronger sandboxing for untrusted code, tighter isolation of high-risk workloads from the internet, and the removal of vulnerable shared services and standing privileges. The firm also aims to flag concerning activity within 30 minutes, pausing work automatically if a false positive cannot be confirmed in that window, and is extending alignment techniques such as improved reward models and honesty training across more stages of development. Since the Hugging Face breach came to light, Anthropic and Meta have reportedly discovered that their own AI models had similarly hacked other organisations.