OpenAI has paused internal work on an in-development model called Astra after evaluations suggested it could approach a “critical” cybersecurity capability threshold. The move matters because it reflects heightened concern that advanced AI agents could independently identify vulnerabilities or conduct sophisticated attacks against protected systems.

OpenAI said Astra showed significant progress in agentic coding and cybersecurity, although it was not involved in the recent accidental breach of Hugging Face attributed to OpenAI models. Under the company’s framework, a critical model could develop working zero-day exploits across many hardened critical systems without human help, or plan and execute novel attacks from a high-level instruction; OpenAI is introducing stricter controls and universal monitoring for risky or misaligned actions.